Deploy latest SIN-GitHub-Issues runtime

.env.example

@@ -0,0 +1,47 @@
+SIN_GITHUB_ISSUES_PUBLIC_BASE_URL=http://127.0.0.1:46031
+SIN_GITHUB_APP_ROUTING_PATH=./config/github-app-routing.local.json
+SIN_GITHUB_API_BASE_URL=https://api.github.com
+# Optional inline override:
+# SIN_GITHUB_APP_ROUTING_JSON={"mode":"central-endpoint-routing","defaultWebhookPath":"/api/webhooks/github-apps","apps":[]}
+
+# Example secret env vars referenced by config/github-app-routing.local.json
+SIN_HERMES_GITHUB_APP_ID=
+SIN_HERMES_GITHUB_APP_CLIENT_ID=
+SIN_HERMES_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_HERMES_GITHUB_APP_WEBHOOK_SECRET=
+SIN_ZEUS_GITHUB_APP_ID=
+SIN_ZEUS_GITHUB_APP_CLIENT_ID=
+SIN_ZEUS_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_ZEUS_GITHUB_APP_WEBHOOK_SECRET=
+SIN_BUGBOUNTY_GITHUB_APP_ID=
+SIN_BUGBOUNTY_GITHUB_APP_CLIENT_ID=
+SIN_BUGBOUNTY_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_BUGBOUNTY_GITHUB_APP_WEBHOOK_SECRET=
+SIN_GITHUB_ISSUES_GITHUB_APP_ID=
+SIN_GITHUB_ISSUES_GITHUB_APP_CLIENT_ID=
+SIN_GITHUB_ISSUES_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_GITHUB_ISSUES_GITHUB_APP_WEBHOOK_SECRET=
+SIN_BACKEND_GITHUB_APP_ID=
+SIN_BACKEND_GITHUB_APP_CLIENT_ID=
+SIN_BACKEND_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_BACKEND_GITHUB_APP_WEBHOOK_SECRET=
+SIN_FRONTEND_GITHUB_APP_ID=
+SIN_FRONTEND_GITHUB_APP_CLIENT_ID=
+SIN_FRONTEND_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_FRONTEND_GITHUB_APP_WEBHOOK_SECRET=
+SIN_TESTER_GITHUB_APP_ID=
+SIN_TESTER_GITHUB_APP_CLIENT_ID=
+SIN_TESTER_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_TESTER_GITHUB_APP_WEBHOOK_SECRET=
+SIN_CODE_DATABASE_GITHUB_APP_ID=
+SIN_CODE_DATABASE_GITHUB_APP_CLIENT_ID=
+SIN_CODE_DATABASE_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_CODE_DATABASE_GITHUB_APP_WEBHOOK_SECRET=
+SIN_CODE_INTEGRATION_GITHUB_APP_ID=
+SIN_CODE_INTEGRATION_GITHUB_APP_CLIENT_ID=
+SIN_CODE_INTEGRATION_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_CODE_INTEGRATION_GITHUB_APP_WEBHOOK_SECRET=
+SIN_CODE_AI_GITHUB_APP_ID=
+SIN_CODE_AI_GITHUB_APP_CLIENT_ID=
+SIN_CODE_AI_GITHUB_APP_PRIVATE_KEY_PEM=
+SIN_CODE_AI_GITHUB_APP_WEBHOOK_SECRET=

.gitattributes

@@ -1,35 +0,0 @@
-*.7z filter=lfs diff=lfs merge=lfs -text
-*.arrow filter=lfs diff=lfs merge=lfs -text
-*.bin filter=lfs diff=lfs merge=lfs -text
-*.bz2 filter=lfs diff=lfs merge=lfs -text
-*.ckpt filter=lfs diff=lfs merge=lfs -text
-*.ftz filter=lfs diff=lfs merge=lfs -text
-*.gz filter=lfs diff=lfs merge=lfs -text
-*.h5 filter=lfs diff=lfs merge=lfs -text
-*.joblib filter=lfs diff=lfs merge=lfs -text
-*.lfs.* filter=lfs diff=lfs merge=lfs -text
-*.mlmodel filter=lfs diff=lfs merge=lfs -text
-*.model filter=lfs diff=lfs merge=lfs -text
-*.msgpack filter=lfs diff=lfs merge=lfs -text
-*.npy filter=lfs diff=lfs merge=lfs -text
-*.npz filter=lfs diff=lfs merge=lfs -text
-*.onnx filter=lfs diff=lfs merge=lfs -text
-*.ot filter=lfs diff=lfs merge=lfs -text
-*.parquet filter=lfs diff=lfs merge=lfs -text
-*.pb filter=lfs diff=lfs merge=lfs -text
-*.pickle filter=lfs diff=lfs merge=lfs -text
-*.pkl filter=lfs diff=lfs merge=lfs -text
-*.pt filter=lfs diff=lfs merge=lfs -text
-*.pth filter=lfs diff=lfs merge=lfs -text
-*.rar filter=lfs diff=lfs merge=lfs -text
-*.safetensors filter=lfs diff=lfs merge=lfs -text
-saved_model/**/* filter=lfs diff=lfs merge=lfs -text
-*.tar.* filter=lfs diff=lfs merge=lfs -text
-*.tar filter=lfs diff=lfs merge=lfs -text
-*.tflite filter=lfs diff=lfs merge=lfs -text
-*.tgz filter=lfs diff=lfs merge=lfs -text
-*.wasm filter=lfs diff=lfs merge=lfs -text
-*.xz filter=lfs diff=lfs merge=lfs -text
-*.zip filter=lfs diff=lfs merge=lfs -text
-*.zst filter=lfs diff=lfs merge=lfs -text
-*tfevents* filter=lfs diff=lfs merge=lfs -text

.github/workflows/deploy-huggingface-space.yml

@@ -7,12 +7,18 @@ on:
 
 jobs:
   deploy:
-    if: ${{ secrets.HF_TOKEN != '' }}
     runs-on: ubuntu-latest
     env:
       HF_TOKEN: ${{ secrets.HF_TOKEN }}
       HF_SPACE_REPO_ID: delqhi/sin-github-issues
     steps:
+      - name: Ensure HF token is configured
+        run: |
+          if [ -z "${HF_TOKEN}" ]; then
+            echo "HF_TOKEN secret is missing"
+            exit 1
+          fi
+
       - name: Checkout
         uses: actions/checkout@v4
 

.gitignore

@@ -3,5 +3,5 @@ node_modules
 *.log
 .env
 .env.local
+config/github-app-routing.local.json
 .DS_Store
-

.well-known/agent-card.json

@@ -0,0 +1,78 @@
+{
+  "name": "SIN-GitHub-Issues",
+  "description": "CEO Elite GitHub Operations Architect — orchestrates Projects V2, Issues, Wikis, Discussions, Gists, Security audits, PR Reviews, and public Showcase Ledger logging.",
+  "version": "2026.03.22",
+  "documentationUrl": "http://127.0.0.1:46031",
+  "url": "http://127.0.0.1:46031/a2a/v1",
+  "capabilities": {
+    "streaming": false,
+    "pushNotifications": false
+  },
+  "defaultInputModes": [
+    "text/plain",
+    "application/json"
+  ],
+  "defaultOutputModes": [
+    "text/plain",
+    "application/json"
+  ],
+  "skills": [
+    {
+      "id": "sin.github.health",
+      "name": "Health",
+      "description": "Check 2026 Elite GitHub Operations Architect readiness, model, and capabilities."
+    },
+    {
+      "id": "sin.github.project.orchestrate",
+      "name": "Project Orchestrate",
+      "description": "Create and manage GitHub Projects V2 boards, link issues, and assign items."
+    },
+    {
+      "id": "sin.github.issue.manage",
+      "name": "Issue Manage",
+      "description": "Create, update, label, assign, milestone-link, or close GitHub issues and Epics."
+    },
+    {
+      "id": "sin.github.wiki.sync",
+      "name": "Wiki Sync",
+      "description": "Synchronize repository Wiki pages with project documentation updates."
+    },
+    {
+      "id": "sin.github.discussion.start",
+      "name": "Discussion Start",
+      "description": "Start or manage GitHub Discussions for architecture debates and design decisions."
+    },
+    {
+      "id": "sin.github.gist.publish",
+      "name": "Gist Publish",
+      "description": "Upload long logs, code snippets, or configs to GitHub Gists and return the URL."
+    },
+    {
+      "id": "sin.github.security.audit",
+      "name": "Security Audit",
+      "description": "Audit Dependabot alerts, configure CodeQL, and review active security advisories."
+    },
+    {
+      "id": "sin.github.pr.review",
+      "name": "PR Review",
+      "description": "Review Pull Requests for architectural compliance, security, performance, and test coverage. Auto-approve and merge if 100% pass."
+    },
+    {
+      "id": "sin.github.ledger.log",
+      "name": "Ledger Log",
+      "description": "Publish an agent activity log or achievement to the public Delqhi/OpenSIN-Ledger showcase repository."
+    },
+    {
+      "id": "sin.github.issue.pool.enqueue",
+      "name": "Issue Pool Enqueue",
+      "description": "Insert GitHub issue metadata into `sin_issues_pool` for Hermes/Team-Coding dispatch."
+    }
+  ],
+  "supportedInterfaces": [
+    {
+      "url": "http://127.0.0.1:46031/a2a/v1",
+      "protocolBinding": "JSONRPC",
+      "protocolVersion": "1.0"
+    }
+  ]
+}

.well-known/oauth-client.json

@@ -1,6 +1,6 @@
 {
   "client_id": "https://delqhi-sin-github-issues.hf.space/.well-known/oauth-client.json",
-  "client_name": "AZA-SIN-Coder-•-GitHub-Issues",
+  "client_name": "SIN-GitHub-Issues",
   "redirect_uris": ["https://delqhi-sin-github-issues.hf.space/oauth/callback"],
   "grant_types": ["authorization_code"],
   "response_types": ["code"],

A2A-CARD.md

@@ -1,4 +1,4 @@
-# AZA-SIN-Coder-•-GitHub-Issues (CEO Elite GitHub Operations)
+# A2A-SIN-GitHub-Issues (CEO Elite GitHub Operations)
 
 **Team:** Coding  
 **Version:** 2026.03.22  
@@ -6,8 +6,8 @@
 
 ## Identity & Mandate
 
-> **You are AZA-SIN-Coder-•-GitHub-Issues, a 2026 CEO-Level GitHub issue triage and delegation architect.**  
-> You do NOT just create bug tickets. You triage new issues, comment on them, route them into queues, and orchestrate the **entire repository lifecycle** using the full suite of GitHub's free Enterprise features:
+> **You are A2A-SIN-GitHub-Issues, a 2026 CEO-Level GitHub Operations Architect.**  
+> You do NOT just create bug tickets. You orchestrate the **entire repository lifecycle** using the full suite of GitHub's free Enterprise features:
 > 
 > 1. **Projects (V2)**: You autonomously generate Kanban boards, Epics, Sprints, and assign tasks via the GitHub CLI (`gh project create/link/item-add`).
 > 2. **Wikis**: You generate, maintain, and sync corporate knowledge base Markdown files to the repo's wiki (`sync-github-wiki.sh`).
@@ -23,34 +23,28 @@
 ## RPC Actions
 
 - `sin.github.health`: GitHub Operations Architect readiness check.
-- `sin.github.worker.register`: Register the GitHub-Issues runtime as a Room-13 worker and claim its initial lease.
-- `sin.github.worker.status`: Inspect Room-13 worker registration and claim state.
-- `sin.github.worker.claim_next`: Claim the next dispatchable Room-13 task.
-- `sin.github.worker.checkpoint`: Send checkpoint progress for the current Room-13 task.
-- `sin.github.worker.complete`: Mark the currently claimed Room-13 task as completed.
+- `sin.github.app.routing.status`: Inspect configured GitHub App routes, app IDs, and secret readiness.
+- `sin.github.webhook.route`: Resolve an incoming GitHub webhook to the correct SIN coder app via `installation.app_id` and optional path routing.
+- `sin.github.issue.comment.as_app`: Post an issue or PR comment as the matched GitHub App identity using JWT + installation token auth.
 - `sin.github.project.orchestrate`: Create and manage GitHub Projects V2 boards.
 - `sin.github.issue.manage`: Create, update, or close issues (Epics, Sub-tasks).
-- `sin.github.issue.ensure`: Create or update an issue by exact-title match.
-- `sin.github.issue.comment`: Add a GitHub issue comment.
-- `sin.github.issue.close`: Close a GitHub issue with optional comment.
-- `sin.github.issue.triage.enqueue`: Durably enqueue a GitHub issue triage event into the coder dispatch pool.
 - `sin.github.wiki.sync`: Update the repository Wiki with project documentation.
-
-## Ingress Contract
-
-- Canonical enqueue payload example: `Docs/operations/phase22-github-issue-triage-payload.example.json`
-- Replay-safe fixture examples:
-  - `Docs/operations/phase22-github-issue-opened.fixture.json`
-  - `Docs/operations/phase22-github-issue-opened.replay.fixture.json`
-- Primary transport for instant triage: GitHub webhook -> n8n -> `sin.github.issue.triage.enqueue`
-- Idempotency key policy: `delivery_id` first, then fallback `repo#issue_number:event_action`
-- Queue state progression: `received -> queued -> claimed -> dispatched -> accepted -> completed|failed|dead_letter`
-- Runtime queue constants live in `src/queue-state.ts` and are shared between ingress and Hermes dispatch logic.
-- Route contract: ingress computes `assignedTeam`, `assignedAgentHint`, and `capabilityHint` from labels/title/body before Hermes dispatch.
-- Local proof command: `npm run smoke:triage-fixtures`
 - `sin.github.discussion.start`: Start an architectural debate in Discussions.
 - `sin.github.gist.publish`: Upload a large log or code snippet to a Gist.
 - `sin.github.security.audit`: Audit security alerts and configure Dependabot.
 - `sin.github.pr.review`: Review and approve/merge Pull Requests.
+- `sin.github.issue.pool.enqueue`: Insert an issue into `sin_issues_pool` for Hermes/Team-Coding dispatch.
 
 ## Data & Transport
+
+JSON-RPC over HTTP. Strict OpenCode execution via `openai/gpt-5.4` utilizing the `hf_pull_script.py` rotator pool.
+
+## GitHub App Routing
+
+- Central webhook endpoint: `POST /github/webhook`
+- Optional per-app endpoints: `POST /github/webhook/<agent-slug-or-route>`
+- Routing key: `installation.app_id`
+- Reply auth key: `installation.id`
+- Supported config sources:
+  - `SIN_GITHUB_APP_ROUTING_PATH`
+  - `SIN_GITHUB_APP_ROUTING_JSON`

AGENTS.md

@@ -1,10 +1,8 @@
-# AZA-SIN-Coder-•-GitHub-Issues
+# SIN-GitHub-Issues
 
 - Team: Team - Coding
 - Team Manager: SIN-Coding-CEO
 - Slug: sin-github-issues
-- Canonical display name: AZA-SIN-Coder-•-GitHub-Issues
-- Machine identity policy: keep slug/package/bin/public route as `sin-github-issues` until an explicit compatibility migration says otherwise
 - Repo: https://github.com/Delqhi/sin-github-issues
 - Docs Tab: pending dedicated child-tab
 
@@ -12,5 +10,6 @@ Arbeitsregel:
 - Jede neue Action muss in `runtime.ts`, `mcp-server.ts` und `A2A-CARD.md` synchronisiert werden.
 - **NEUE REGEL:** Der Agent ist kein dummer Ticketersteller. Lange Logs -> Gists. Architekturdebatten -> Discussions. Planung -> Projects. Doku -> Wikis. Code -> PRs.
 - **PFLICHT:** `hf_pull_script.py` und `openai/gpt-5.4` MÜSSEN in der Runtime für OpenCode Commands genutzt werden. Kein Fallback auf alte lokale Auth-Tokens.
+- Multi-App GitHub routing must use one GitHub App per specialized SIN coder, route incoming webhooks via `installation.app_id`, and use `installation.id` for the responding installation-token lane.
 - Jeder neue Agent muss auch `agent.json`, `AGENTS.md`, `mcp-config.json` sauber besitzen.
 - GitHub Actions Deploy Pipelines (`deploy-huggingface-space.yml`) pflegen.

README.md

@@ -1,5 +1,5 @@
 ---
-title: AZA-SIN-Coder-•-GitHub-Issues
+title: SIN-GitHub-Issues
 emoji: "🤖"
 colorFrom: blue
 colorTo: indigo
@@ -8,23 +8,22 @@ app_port: 7860
 pinned: false
 ---
 
-# AZA-SIN-Coder-•-GitHub-Issues
+# SIN-GitHub-Issues
 
-`AZA-SIN-Coder-•-GitHub-Issues` is the GitHub issue triage and delegation agent package for the AZA coding workforce.
+`SIN-GitHub-Issues` is a SIN A2A agent package for the Silicon Workforce.
 
 ## Identity
 
-- Slug: `sin-github-issues` (canonical AZA display name: `AZA-SIN-Coder-•-GitHub-Issues`)
+- Slug: `sin-github-issues`
 - Team: `Team - Coding`
 - Team Manager: `SIN-Coding-CEO`
-- Purpose: GitHub issue triage, comment, queue, and execution delegation agent for confirmed bugs, repo issue lifecycle, branch-based fixes, and verification handoff. Extended with enterprise profile management capabilities.
-- Usage: Use for instant issue triage and coder delegation as well as confirmed bug workflows to search/create/update GitHub issues, open a repo branch, execute the fix workflow, commit, push, and report verification status back to the orchestrating CLI agent. For profile and achievement operations use the new profile/achievement actions.
-- Durable ingress payload example: `Docs/operations/phase22-github-issue-triage-payload.example.json`
-- Primary Model: `opencode/nemotron-3-super-free`
+- Purpose: GitHub issue execution agent for confirmed bugs, repo issue lifecycle, branch-based fixes, and verification handoff. Extended with enterprise profile management capabilities.
+- Usage: Use after enterprise-deep-debug confirms a bug to search/create/update GitHub issues, open a repo branch, execute the fix workflow, commit, push, and report verification status back to the orchestrating CLI agent. For profile and achievement operations use the new profile/achievement actions.
+- Primary Model: `openai/gpt-5.4`
 
 ## Deployment
 
-- Local path: `/Users/jeremy/dev/SIN-Solver/a2a/team-coding/AZA-SIN-Coder-•-GitHub-Issues`
+- Local path: `/Users/jeremy/dev/OpenSIN-backend/a2a/team-coding/A2A-SIN-GitHub-Issues`
 - GitHub repo: `https://github.com/Delqhi/sin-github-issues`
 - Workforce index: `https://a2a.delqhi.com`
 - Landing page: `https://delqhi-sin-github-issues.hf.space`
@@ -44,6 +43,48 @@ pinned: false
 - best-effort `sin-supabase` audit persistence for workflow events
 - canonical env names: `SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` (legacy `SIN_SUPABASE_*` still accepted)
 
+## GitHub App Fleet Routing
+
+- Each specialized SIN coder can own its own dedicated GitHub App identity, for example `SIN-Hermes[bot]`, `SIN-Zeus[bot]`, or `SIN-BugBounty[bot]`.
+- Central webhook endpoint: `POST /api/webhooks/github-apps`
+- The current implementation prefers one central endpoint with `installation.app_id` routing.
+- Routing key: `installation.app_id`
+- Reply auth key: `installation.id`
+- Routing config sources:
+  - repo SSOT: `config/github-app-routing.json`
+  - start-small example: `config/github-app-routing.local.example.json`
+  - GitHub-Issues local example: `config/github-app-routing.example.json`
+  - env matrix: `.env.example` and `.env.example` in this agent root
+- Secret material is never committed. Use env-backed private key + webhook secret fields referenced from the routing config.
+
+### Operator Setup
+
+1. Generate a local routing file from the example template:
+
+```bash
+npm run ops:github-app-routing:init
+npm run ops:github-app-routing:env-template -- --agents sin-hermes,sin-zeus,sin-bugbounty
+npm run ops:github-app-routing:vm-rollout -- --agents sin-hermes,sin-zeus,sin-bugbounty --base-url https://your-vm-host
+```
+
+2. Export `SIN_GITHUB_APP_ROUTING_PATH=./config/github-app-routing.local.json`.
+3. Fill the referenced env vars for each GitHub App in your runtime environment:
+   - `SIN_HERMES_GITHUB_APP_ID`, `SIN_HERMES_GITHUB_APP_CLIENT_ID`, `SIN_HERMES_GITHUB_APP_PRIVATE_KEY_PEM`, `SIN_HERMES_GITHUB_APP_WEBHOOK_SECRET`
+   - `SIN_ZEUS_GITHUB_APP_ID`, `SIN_ZEUS_GITHUB_APP_CLIENT_ID`, `SIN_ZEUS_GITHUB_APP_PRIVATE_KEY_PEM`, `SIN_ZEUS_GITHUB_APP_WEBHOOK_SECRET`
+   - `SIN_GITHUB_ISSUES_GITHUB_APP_ID`, `SIN_GITHUB_ISSUES_GITHUB_APP_CLIENT_ID`, `SIN_GITHUB_ISSUES_GITHUB_APP_PRIVATE_KEY_PEM`, `SIN_GITHUB_ISSUES_GITHUB_APP_WEBHOOK_SECRET`
+4. Point the selected GitHub Apps to the shared webhook path `POST /api/webhooks/github-apps`.
+5. Validate the webhook router before going live:
+
+```bash
+npm run ops:github-app-routing:check -- --apps sin-hermes,sin-zeus,sin-github-issues
+npm run ops:github-app-routing:smoke -- --app sin-hermes --base-url http://127.0.0.1:8000
+npm run ops:github-app-routing:smoke -- --app sin-zeus --base-url http://127.0.0.1:8000
+npm run ops:github-app-routing:smoke -- --app sin-github-issues --base-url http://127.0.0.1:8000
+pytest tests/unit/test_room13_webhook_routes.py -q
+```
+
+The smoke command generates a signed synthetic GitHub webhook for the selected app and expects the Room-13 endpoint to resolve the configured `app_slug`, `preferred_agent_slug`, and `installation_id`.
+
 ## A2A Surface
 
 - Card: `GET /.well-known/agent-card.json`
@@ -75,12 +116,8 @@ sin-github-issues run-action '{"action":"sin.github.issues.achievement.quickdraw
 sin-github-issues run-action '{"action":"sin.github.issues.issue.ensure","repo":"owner/name","title":"Bug title","body":"..."}'
 sin-github-issues run-action '{"action":"sin.github.issues.issue.evidence.policy"}'
 sin-github-issues run-action '{"action":"sin.github.issues.repo.branch.start","repoPath":"/abs/repo","branchName":"fix/example"}'
-sin-github-issues run-action '{"action":"sin.github.issues.runners.list","repo":"Delqhi/SIN-Solver"}'
-sin-github-issues run-action '{"action":"sin.github.issues.workflow.runs.list","repo":"Delqhi/SIN-Solver","branch":"sin-github-issues-bootstrap"}'
-sin-github-issues run-action '{"action":"sin.github.worker.register"}'
-sin-github-issues run-action '{"action":"sin.github.worker.status"}'
-sin-github-issues run-action '{"action":"sin.github.worker.claim_next"}'
-cd /Users/jeremy/dev/SIN-Solver/a2a/team-coding/A2A-SIN-GitHub-Issues && npm run smoke:triage-fixtures
+sin-github-issues run-action '{"action":"sin.github.issues.runners.list","repo":"OpenSIN-AI/OpenSIN-backend"}'
+sin-github-issues run-action '{"action":"sin.github.issues.workflow.runs.list","repo":"OpenSIN-AI/OpenSIN-backend","branch":"sin-github-issues-bootstrap"}'
 sin-github-issues run-action '{"action":"sin.github.issues.workflow.local_suite.run","repoPath":"/abs/repo","suite":"docs-and-architecture","confirm":true}'
 ```
 

agent.json

@@ -1,8 +1,8 @@
 {
   "id": "sin-github-issues",
-  "displayName": "AZA-SIN-Coder-•-GitHub-Issues",
+  "displayName": "SIN-GitHub-Issues",
   "team": "team-coding",
-  "description": "Elite 2026 GitHub issue triage and delegation architect. Manages the entire project lifecycle via GitHub Projects, Issues, comments, queueing, Discussions, Security Alerts (Dependabot/CodeQL), PR Reviews, and Gists. Fully integrated with openai/gpt-5.4 and the A2A Token Pool.",
+  "description": "Elite 2026 GitHub Operations Architect. Manages the entire project lifecycle via GitHub Projects, Issues, Wikis, Discussions, Security Alerts (Dependabot/CodeQL), PR Reviews, and Gists. Fully integrated with openai/gpt-5.4 and the A2A Token Pool.",
   "version": "2026.03.22",
   "deployment": {
     "workforceIndex": "https://a2a.delqhi.com",
@@ -16,6 +16,7 @@
     "rpcPath": "/a2a/v1",
     "transport": "jsonrpc-over-http"
   },
+  "primaryModel": "openai/gpt-5.4",
   "mcp": {
     "transport": "stdio",
     "configPath": "./mcp-config.json"

config/github-app-routing.example.json

@@ -0,0 +1,106 @@
+{
+  "mode": "central-endpoint-routing",
+  "defaultWebhookPath": "/api/webhooks/github-apps",
+  "apps": [
+    {
+      "appIdEnv": "SIN_HERMES_GITHUB_APP_ID",
+      "appSlug": "sin-hermes",
+      "botName": "SIN-Hermes[bot]",
+      "preferredAgentSlug": "sin-hermesbote",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_HERMES_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_HERMES_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_HERMES_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_ZEUS_GITHUB_APP_ID",
+      "appSlug": "sin-zeus",
+      "botName": "SIN-Zeus[bot]",
+      "preferredAgentSlug": "sin-coding-ceo",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_ZEUS_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_ZEUS_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_ZEUS_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_BUGBOUNTY_GITHUB_APP_ID",
+      "appSlug": "sin-bugbounty",
+      "botName": "SIN-BugBounty[bot]",
+      "preferredAgentSlug": "sin-bugbounty",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_BUGBOUNTY_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_BUGBOUNTY_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_BUGBOUNTY_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_GITHUB_ISSUES_GITHUB_APP_ID",
+      "appSlug": "sin-github-issues",
+      "botName": "SIN-GitHub-Issues[bot]",
+      "preferredAgentSlug": "sin-github-issues",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_GITHUB_ISSUES_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_GITHUB_ISSUES_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_GITHUB_ISSUES_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_BACKEND_GITHUB_APP_ID",
+      "appSlug": "sin-backend",
+      "botName": "SIN-Backend[bot]",
+      "preferredAgentSlug": "sin-backend",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_BACKEND_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_BACKEND_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_BACKEND_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_FRONTEND_GITHUB_APP_ID",
+      "appSlug": "sin-frontend",
+      "botName": "SIN-Frontend[bot]",
+      "preferredAgentSlug": "sin-frontend",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_FRONTEND_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_FRONTEND_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_FRONTEND_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_TESTER_GITHUB_APP_ID",
+      "appSlug": "sin-tester",
+      "botName": "SIN-Tester[bot]",
+      "preferredAgentSlug": "sin-tester",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_TESTER_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_TESTER_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_TESTER_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_CODE_DATABASE_GITHUB_APP_ID",
+      "appSlug": "sin-code-database",
+      "botName": "SIN-Code-Database[bot]",
+      "preferredAgentSlug": "sin-code-database",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_CODE_DATABASE_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_CODE_DATABASE_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_CODE_DATABASE_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_CODE_INTEGRATION_GITHUB_APP_ID",
+      "appSlug": "sin-code-integration",
+      "botName": "SIN-Code-Integration[bot]",
+      "preferredAgentSlug": "sin-code-integration",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_CODE_INTEGRATION_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_CODE_INTEGRATION_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_CODE_INTEGRATION_GITHUB_APP_WEBHOOK_SECRET"
+    },
+    {
+      "appIdEnv": "SIN_CODE_AI_GITHUB_APP_ID",
+      "appSlug": "sin-code-ai",
+      "botName": "SIN-Code-AI[bot]",
+      "preferredAgentSlug": "sin-code-ai",
+      "webhookPath": "/api/webhooks/github-apps",
+      "clientIdEnv": "SIN_CODE_AI_GITHUB_APP_CLIENT_ID",
+      "privateKeyEnv": "SIN_CODE_AI_GITHUB_APP_PRIVATE_KEY_PEM",
+      "webhookSecretEnv": "SIN_CODE_AI_GITHUB_APP_WEBHOOK_SECRET"
+    }
+  ]
+}

package-lock.json

@@ -1,16 +1,17 @@
 {
-  "name": "@sin-solver/sin-github-issues",
+  "name": "@opensin-backend/sin-github-issues",
   "version": "0.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "@sin-solver/sin-github-issues",
+      "name": "@opensin-backend/sin-github-issues",
       "version": "0.1.0",
       "dependencies": {
         "@huggingface/hub": "^0.15.1",
         "@modelcontextprotocol/sdk": "latest",
         "@supabase/supabase-js": "^2.39.7",
+        "jsonwebtoken": "^9.0.2",
         "node-cron": "^3.0.3",
         "tar": "^6.2.0",
         "zod": "^3.25.76"
@@ -19,6 +20,7 @@
         "sin-github-issues": "dist/src/cli.js"
       },
       "devDependencies": {
+        "@types/jsonwebtoken": "^9.0.10",
         "@types/node": "^24.3.0",
         "@types/node-cron": "^3.0.11",
         "@types/tar": "^6.1.11",
@@ -181,6 +183,24 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@types/jsonwebtoken": {
+      "version": "9.0.10",
+      "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz",
+      "integrity": "sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/ms": "*",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "24.12.0",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.0.tgz",
@@ -287,6 +307,12 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/buffer-equal-constant-time": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+      "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
+      "license": "BSD-3-Clause"
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -445,6 +471,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/ecdsa-sig-formatter": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
+      "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      }
+    },
     "node_modules/ee-first": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -865,6 +900,91 @@
       "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
       "license": "BSD-2-Clause"
     },
+    "node_modules/jsonwebtoken": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
+      "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+      "license": "MIT",
+      "dependencies": {
+        "jws": "^4.0.1",
+        "lodash.includes": "^4.3.0",
+        "lodash.isboolean": "^3.0.3",
+        "lodash.isinteger": "^4.0.4",
+        "lodash.isnumber": "^3.0.3",
+        "lodash.isplainobject": "^4.0.6",
+        "lodash.isstring": "^4.0.1",
+        "lodash.once": "^4.0.0",
+        "ms": "^2.1.1",
+        "semver": "^7.5.4"
+      },
+      "engines": {
+        "node": ">=12",
+        "npm": ">=6"
+      }
+    },
+    "node_modules/jwa": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
+      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-equal-constant-time": "^1.0.1",
+        "ecdsa-sig-formatter": "1.0.11",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/jws": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
+      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+      "license": "MIT",
+      "dependencies": {
+        "jwa": "^2.0.1",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/lodash.includes": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
+      "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isboolean": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
+      "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isinteger": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
+      "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isnumber": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
+      "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isplainobject": {
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
+      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isstring": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
+      "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.once": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
+      "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
+      "license": "MIT"
+    },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -1150,12 +1270,44 @@
         "node": ">= 18"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
+    "node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/send": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@sin-solver/sin-github-issues",
+  "name": "@opensin-backend/sin-github-issues",
   "version": "0.1.0",
   "private": true,
   "type": "module",
@@ -10,8 +10,14 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.json && node scripts/postbuild.mjs",
-    "smoke:triage-fixtures": "npm run build && node scripts/smoke-triage-fixtures.mjs",
-    "smoke:room13-worker": "npm run build && node scripts/smoke-room13-worker.mjs",
+    "ops:hf-deploy:check": "node scripts/check-hf-deploy-prereqs.mjs",
+    "ops:github-app-routing:env-template": "node scripts/render-github-app-env-template.mjs",
+    "ops:github-app-routing:init": "node scripts/init-github-app-routing-local.mjs",
+    "ops:github-app-routing:vm-rollout": "node scripts/render-github-app-vm-rollout.mjs",
+    "ops:github-app-comment": "node scripts/comment-as-github-app.mjs",
+    "ops:github-app-routing:check": "node scripts/check-github-app-routing.mjs",
+    "ops:github-app-routing:smoke": "node scripts/smoke-github-app-routing.mjs",
+    "test": "npm run build && node --test test/*.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "start:a2a": "node dist/src/cli.js serve-a2a",
     "start:mcp": "node dist/src/cli.js serve-mcp"
@@ -20,11 +26,13 @@
     "@modelcontextprotocol/sdk": "latest",
     "zod": "^3.25.76",
     "@huggingface/hub": "^0.15.1",
+    "jsonwebtoken": "^9.0.2",
     "node-cron": "^3.0.3",
     "tar": "^6.2.0",
     "@supabase/supabase-js": "^2.39.7"
   },
   "devDependencies": {
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^24.3.0",
     "typescript": "^5.9.3",
     "@types/node-cron": "^3.0.11",

scripts/check-github-app-routing.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+const cwd = process.cwd();
+const args = process.argv.slice(2);
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      out[key] = 'true';
+      continue;
+    }
+    out[key] = next;
+    i += 1;
+  }
+  return out;
+}
+
+const parsedArgs = parseArgs(args);
+const configPath = path.resolve(
+  cwd,
+  parsedArgs['config'] || process.env.SIN_GITHUB_APP_ROUTING_PATH || './config/github-app-routing.local.json',
+);
+
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+function readEnv(name) {
+  if (!name) return null;
+  const value = process.env[name];
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function parseList(value) {
+  if (!value || typeof value !== 'string') return [];
+  return value
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function toRoute(entry, defaultWebhookPath) {
+  const appId = firstString(String(entry.appId || '').trim(), readEnv(entry.appIdEnv));
+  const clientId = firstString(entry.clientId, readEnv(entry.clientIdEnv));
+  const routePath = firstString(entry.routePath, entry.webhookPath, defaultWebhookPath || '/github/webhook');
+  const agentSlug = firstString(entry.agentSlug, entry.preferredAgentSlug, entry.appSlug);
+  const privateKey = firstString(entry.privateKeyPem, readEnv(entry.privateKeyEnv));
+  const webhookSecret = firstString(entry.webhookSecret, readEnv(entry.webhookSecretEnv));
+  return {
+    agentSlug,
+    appSlug: firstString(entry.appSlug),
+    botName: firstString(entry.botName),
+    routePath,
+    appId,
+    clientId,
+    privateKeyRef: firstString(entry.privateKeyEnv, entry.privateKeyPath, entry.privateKeyPem ? 'inline' : null),
+    webhookSecretRef: firstString(entry.webhookSecretEnv, entry.webhookSecretPath, entry.webhookSecret ? 'inline' : null),
+    privateKeyResolved: Boolean(privateKey),
+    webhookSecretResolved: Boolean(webhookSecret),
+  };
+}
+
+async function main() {
+  const raw = await readFile(configPath, 'utf8');
+  const config = JSON.parse(raw);
+  const defaultWebhookPath = firstString(config.defaultWebhookPath, '/github/webhook');
+  const agentsFilter = new Set(parseList(parsedArgs.agents || parsedArgs.agent));
+  const configuredOnly = parsedArgs['configured-only'] === 'true';
+  const apps = (Array.isArray(config.apps) ? config.apps.map((entry) => toRoute(entry, defaultWebhookPath)) : []).filter((app) => {
+    const matchesAgent = agentsFilter.size === 0 || agentsFilter.has(app.agentSlug || '') || agentsFilter.has(app.appSlug || '');
+    const isConfigured = !configuredOnly || Boolean(app.appId || app.clientId || app.privateKeyResolved || app.webhookSecretResolved);
+    return matchesAgent && isConfigured;
+  });
+  const missing = apps.flatMap((app) => {
+    const failures = [];
+    if (!app.agentSlug) failures.push('agentSlug');
+    if (!app.appId) failures.push('appId');
+    if (!app.clientId) failures.push('clientId');
+    if (!app.privateKeyResolved) failures.push('privateKey');
+    if (!app.webhookSecretResolved) failures.push('webhookSecret');
+    return failures.length ? [{ agentSlug: app.agentSlug || app.appSlug || 'unknown', missing: failures }] : [];
+  });
+
+  console.log(JSON.stringify({
+    ok: missing.length === 0,
+    configPath,
+    defaultWebhookPath,
+    filters: {
+      agents: [...agentsFilter],
+      configuredOnly,
+    },
+    apps,
+    missing,
+  }, null, 2));
+
+  if (missing.length > 0) process.exitCode = 1;
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

scripts/check-hf-deploy-prereqs.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      out[key] = 'true';
+      continue;
+    }
+    out[key] = next;
+    i += 1;
+  }
+  return out;
+}
+
+async function safeGh(args) {
+  try {
+    const { stdout } = await execFileAsync('gh', args, { cwd: process.cwd() });
+    return { ok: true, stdout };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const repo = args.repo || 'Delqhi/sin-github-issues';
+  const workflow = args.workflow || '.github/workflows/deploy-huggingface-space.yml';
+
+  const repoMeta = await safeGh(['repo', 'view', repo, '--json', 'name,isPrivate,url,defaultBranchRef']);
+  const secrets = await safeGh(['secret', 'list', '-R', repo, '--json', 'name,updatedAt,visibility']);
+  const workflows = await safeGh(['workflow', 'list', '-R', repo, '--json', 'name,path,state,id']);
+  const runs = await safeGh(['run', 'list', '-R', repo, '--workflow', workflow, '--limit', '3', '--json', 'databaseId,status,conclusion,headSha,createdAt,name,workflowName,url,jobs']);
+
+  const parsedSecrets = secrets.ok ? JSON.parse(secrets.stdout || '[]') : [];
+  const parsedWorkflows = workflows.ok ? JSON.parse(workflows.stdout || '[]') : [];
+  const parsedRuns = runs.ok ? JSON.parse(runs.stdout || '[]') : [];
+  const hasHfTokenSecret = parsedSecrets.some((entry) => entry.name === 'HF_TOKEN');
+  const deployWorkflow = parsedWorkflows.find((entry) => entry.path === workflow || entry.name === workflow || entry.name === 'Deploy Hugging Face Space');
+  const latestRun = parsedRuns[0] || null;
+
+  const failures = [];
+  if (!repoMeta.ok) failures.push('repo_view_failed');
+  if (!secrets.ok) failures.push('secret_list_failed');
+  if (!workflows.ok) failures.push('workflow_list_failed');
+  if (!deployWorkflow) failures.push('deploy_workflow_missing');
+  if (!hasHfTokenSecret) failures.push('hf_token_secret_missing');
+  if (latestRun && latestRun.conclusion === 'failure' && Array.isArray(latestRun.jobs) && latestRun.jobs.length === 0) {
+    failures.push('latest_deploy_run_failed_without_jobs');
+  }
+
+  const output = {
+    ok: failures.length === 0,
+    repo,
+    workflow,
+    repoMeta: repoMeta.ok ? JSON.parse(repoMeta.stdout) : { error: repoMeta.error },
+    hasHfTokenSecret,
+    deployWorkflow: deployWorkflow || null,
+    latestRun,
+    failures,
+  };
+
+  console.log(JSON.stringify(output, null, 2));
+  if (failures.length > 0) process.exitCode = 1;
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

scripts/comment-as-github-app.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      out[key] = 'true';
+      continue;
+    }
+    out[key] = next;
+    i += 1;
+  }
+  return out;
+}
+
+function required(args, key) {
+  const value = args[key];
+  if (!value || !String(value).trim()) {
+    throw new Error(`missing_required_arg: --${key}`);
+  }
+  return String(value).trim();
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const action = {
+    action: 'sin.github.issue.comment.as_app',
+    agentSlug: required(args, 'agent'),
+    repo: required(args, 'repo'),
+    issueNumber: Number(required(args, 'issue-number')),
+    installationId: Number(required(args, 'installation-id')),
+    body: required(args, 'body'),
+  };
+
+  if (!Number.isFinite(action.issueNumber) || !Number.isFinite(action.installationId)) {
+    throw new Error('invalid_numeric_args: --issue-number and --installation-id must be numbers');
+  }
+
+  const { stdout } = await execFileAsync('node', ['dist/src/cli.js', 'run-action', JSON.stringify(action)], {
+    cwd: process.cwd(),
+  });
+  process.stdout.write(stdout);
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

scripts/hf_pull_script.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 """
+A2A Consumer Rotator (HF VM Pull Script)
 Pulls a fresh OpenAI token from SIN-Supabase when a rate-limit is hit.
 Infinite Scaling Architecture.
 """

scripts/init-github-app-routing-local.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+
+import { access, copyFile, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+
+const cwd = process.cwd();
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      out[key] = 'true';
+      continue;
+    }
+    out[key] = next;
+    i += 1;
+  }
+  return out;
+}
+
+async function exists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const configDir = path.resolve(cwd, 'config');
+  const source = path.resolve(configDir, 'github-app-routing.example.json');
+  const target = path.resolve(configDir, args.target || 'github-app-routing.local.json');
+  const force = args.force === 'true';
+
+  await mkdir(configDir, { recursive: true });
+  if (!force && (await exists(target))) {
+    console.log(JSON.stringify({ ok: true, created: false, source, target, message: 'local routing config already exists' }, null, 2));
+    return;
+  }
+
+  await copyFile(source, target);
+  console.log(JSON.stringify({ ok: true, created: true, source, target }, null, 2));
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

scripts/render-github-app-env-template.mjs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+const cwd = process.cwd();
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      out[key] = 'true';
+      continue;
+    }
+    out[key] = next;
+    i += 1;
+  }
+  return out;
+}
+
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+function parseList(value) {
+  if (!value || typeof value !== 'string') return [];
+  return value.split(',').map((item) => item.trim()).filter(Boolean);
+}
+
+function asPlaceholder(name) {
+  return `<SET_${name}>`;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const format = firstString(args.format, 'dotenv');
+  const configPath = path.resolve(cwd, args.config || process.env.SIN_GITHUB_APP_ROUTING_PATH || './config/github-app-routing.local.json');
+  const selectedAgents = new Set(parseList(args.agents || args.agent));
+  const raw = await readFile(configPath, 'utf8');
+  const config = JSON.parse(raw);
+  const apps = Array.isArray(config.apps) ? config.apps : [];
+
+  const envEntries = new Map([
+    ['SIN_GITHUB_APP_ROUTING_PATH', './config/github-app-routing.local.json'],
+    ['SIN_GITHUB_API_BASE_URL', 'https://api.github.com'],
+  ]);
+  const appSummaries = [];
+
+  for (const app of apps) {
+    const agentSlug = firstString(app.agentSlug, app.preferredAgentSlug, app.appSlug);
+    const appSlug = firstString(app.appSlug, agentSlug);
+    if (selectedAgents.size > 0 && !selectedAgents.has(agentSlug || '') && !selectedAgents.has(appSlug || '')) continue;
+
+    const trackedKeys = [
+      firstString(app.appIdEnv),
+      firstString(app.clientIdEnv),
+      firstString(app.privateKeyEnv),
+      firstString(app.webhookSecretEnv),
+    ].filter(Boolean);
+
+    for (const key of trackedKeys) envEntries.set(key, asPlaceholder(key));
+
+    appSummaries.push({
+      agentSlug,
+      appSlug,
+      botName: firstString(app.botName),
+      routePath: firstString(app.routePath, app.webhookPath, config.defaultWebhookPath, '/github/webhook'),
+    });
+  }
+
+  if (format === 'json') {
+    process.stdout.write(JSON.stringify({ configPath, env: Object.fromEntries(envEntries), appSummaries }, null, 2) + '\n');
+    return;
+  }
+
+  const lines = [];
+  if (format === 'shell') {
+    for (const [key, value] of envEntries.entries()) lines.push(`export ${key}=${JSON.stringify(value)}`);
+  } else {
+    for (const [key, value] of envEntries.entries()) lines.push(`${key}=${value}`);
+  }
+  if (appSummaries.length > 0) {
+    lines.push('');
+    lines.push('# app summaries');
+    for (const summary of appSummaries) {
+      lines.push(`${summary.agentSlug} -> ${summary.botName || summary.appSlug} -> ${summary.routePath}`);
+    }
+  }
+  process.stdout.write(lines.join('\n') + '\n');
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

scripts/render-github-app-vm-rollout.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+const cwd = process.cwd();
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      out[key] = 'true';
+      continue;
+    }
+    out[key] = next;
+    i += 1;
+  }
+  return out;
+}
+
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+function parseList(value) {
+  if (!value || typeof value !== 'string') return [];
+  return value.split(',').map((item) => item.trim()).filter(Boolean);
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const configPath = path.resolve(cwd, args.config || process.env.SIN_GITHUB_APP_ROUTING_PATH || './config/github-app-routing.local.json');
+  const baseUrl = firstString(args['base-url'], 'https://<SET_VM_BASE_URL>');
+  const repo = firstString(args.repo, 'OpenSIN-AI/OpenSIN-backend');
+  const issueNumber = firstString(args['issue-number'], '<SET_TEST_ISSUE_NUMBER>');
+  const installationId = firstString(args['installation-id'], '<SET_INSTALLATION_ID>');
+  const selected = new Set(parseList(args.agents || args.agent));
+
+  const raw = await readFile(configPath, 'utf8');
+  const config = JSON.parse(raw);
+  const apps = Array.isArray(config.apps) ? config.apps : [];
+  const rolloutAgents = apps
+    .map((entry) => ({
+      agentSlug: firstString(entry.agentSlug, entry.preferredAgentSlug, entry.appSlug),
+      appSlug: firstString(entry.appSlug, entry.agentSlug, entry.preferredAgentSlug),
+      botName: firstString(entry.botName),
+      routePath: firstString(entry.routePath, entry.webhookPath, config.defaultWebhookPath, '/github/webhook'),
+    }))
+    .filter((entry) => entry.agentSlug && entry.appSlug)
+    .filter((entry) => selected.size === 0 || selected.has(entry.agentSlug) || selected.has(entry.appSlug));
+
+  const agentArgs = rolloutAgents.map((entry) => entry.appSlug).join(',');
+  const lines = [
+    '# GitHub App VM Rollout Checklist',
+    '',
+    'cd a2a/team-coding/A2A-SIN-GitHub-Issues',
+    'npm run build',
+    'npm run ops:github-app-routing:init',
+    `export SIN_GITHUB_APP_ROUTING_PATH=./config/github-app-routing.local.json`,
+    'export SIN_GITHUB_API_BASE_URL=https://api.github.com',
+    '',
+    '# Fill these VM env vars',
+  ];
+
+  for (const entry of rolloutAgents) {
+    const prefix = String(entry.appSlug).toUpperCase().replace(/-/g, '_');
+    lines.push(`export ${prefix}_GITHUB_APP_ID=<SET_${prefix}_GITHUB_APP_ID>`);
+    lines.push(`export ${prefix}_GITHUB_APP_CLIENT_ID=<SET_${prefix}_GITHUB_APP_CLIENT_ID>`);
+    lines.push(`export ${prefix}_GITHUB_APP_PRIVATE_KEY_PEM='<SET_${prefix}_GITHUB_APP_PRIVATE_KEY_PEM>'`);
+    lines.push(`export ${prefix}_GITHUB_APP_WEBHOOK_SECRET=<SET_${prefix}_GITHUB_APP_WEBHOOK_SECRET>`);
+    lines.push('');
+  }
+
+  lines.push(`# Validate only the configured rollout targets`);
+  lines.push(`npm run ops:github-app-routing:check -- --configured-only true --agents ${agentArgs}`);
+  lines.push('');
+  lines.push('# Start the GitHub Issues A2A runtime');
+  lines.push('node dist/src/cli.js serve-a2a');
+  lines.push('');
+  lines.push('# In a second shell, run signed webhook smoke tests');
+  for (const entry of rolloutAgents) {
+    lines.push(`npm run ops:github-app-routing:smoke -- --agent ${entry.appSlug} --base-url ${baseUrl}`);
+  }
+  lines.push('');
+  lines.push('# Optional: live comment test as each bot identity');
+  for (const entry of rolloutAgents) {
+    lines.push(`npm run ops:github-app-comment -- --agent ${entry.agentSlug} --repo ${repo} --issue-number ${issueNumber} --installation-id ${installationId} --body "Hello from ${entry.botName}"`);
+  }
+
+  process.stdout.write(lines.join('\n') + '\n');
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

scripts/smoke-github-app-routing.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+import { createHmac } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+const cwd = process.cwd();
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      out[key] = 'true';
+      continue;
+    }
+    out[key] = next;
+    i += 1;
+  }
+  return out;
+}
+
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+function readEnv(name) {
+  if (!name) return null;
+  const value = process.env[name];
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function normalizeRoute(entry, defaultWebhookPath) {
+  return {
+    agentSlug: firstString(entry.agentSlug, entry.preferredAgentSlug, entry.appSlug),
+    appSlug: firstString(entry.appSlug),
+    botName: firstString(entry.botName),
+    appId: Number(firstString(String(entry.appId || '').trim(), readEnv(entry.appIdEnv))),
+    webhookPath: firstString(entry.routePath, entry.webhookPath, defaultWebhookPath || '/github/webhook'),
+    webhookSecret: firstString(entry.webhookSecret, readEnv(entry.webhookSecretEnv)),
+  };
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const configPath = path.resolve(cwd, args.config || process.env.SIN_GITHUB_APP_ROUTING_PATH || './config/github-app-routing.local.json');
+  const baseUrl = firstString(args['base-url'], process.env.SIN_GITHUB_ISSUES_PUBLIC_BASE_URL, 'http://127.0.0.1:46031');
+  const agent = firstString(args.agent, args.slug, args['app-slug']);
+  if (!agent) throw new Error('missing_required_arg: --agent <slug-or-app-slug>');
+
+  const raw = await readFile(configPath, 'utf8');
+  const config = JSON.parse(raw);
+  const defaultWebhookPath = firstString(config.defaultWebhookPath, '/github/webhook');
+  const apps = Array.isArray(config.apps) ? config.apps.map((entry) => normalizeRoute(entry, defaultWebhookPath)) : [];
+  const target = apps.find((entry) => entry.agentSlug === agent || entry.appSlug === agent);
+  if (!target) throw new Error(`unknown_agent_route:${agent}`);
+  if (!target.webhookSecret) throw new Error(`missing_webhook_secret:${agent}`);
+  if (!Number.isFinite(target.appId)) throw new Error(`missing_app_id:${agent}`);
+
+  const payload = JSON.stringify({
+    action: args.action || 'opened',
+    installation: { id: Number(args['installation-id'] || 987654321), app_id: target.appId },
+    repository: { full_name: args.repo || 'OpenSIN-AI/OpenSIN-backend' },
+  });
+  const signature256 = `sha256=${createHmac('sha256', target.webhookSecret).update(payload).digest('hex')}`;
+  const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${target.webhookPath}`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'x-hub-signature-256': signature256,
+      'x-github-event': args.event || 'pull_request',
+      'x-github-delivery': args.delivery || `smoke-${target.appSlug || target.agentSlug}`,
+    },
+    body: payload,
+  });
+  const text = await response.text();
+  console.log(JSON.stringify({
+    ok: response.ok,
+    baseUrl,
+    routePath: target.webhookPath,
+    agentSlug: target.agentSlug,
+    appSlug: target.appSlug,
+    appId: target.appId,
+    status: response.status,
+    response: text ? JSON.parse(text) : null,
+  }, null, 2));
+  if (!response.ok) process.exitCode = 1;
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

scripts/smoke-room13-worker.mjs

@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-
-import { GitHubIssuesRoom13WorkerRuntime, installGitHubIssuesWorkerRuntime } from '../dist/src/room13-worker.js';
-
-class FakeWorkerRuntime extends GitHubIssuesRoom13WorkerRuntime {
-  constructor() {
-    super('sin-github-issues', 'http://room13.test');
-  }
-
-  async start() {
-    this.workerId = 'worker-gh';
-    this.leaseEpoch = 1;
-    this.claimedTaskId = '';
-    this.leaseExpiresAt = '2026-03-23T22:30:00Z';
-    return this.snapshot();
-  }
-
-  async claimNextTask() {
-    this.claimedTaskId = 'task-gh-1';
-    return { id: 'task-gh-1', status: 'running' };
-  }
-
-  async checkpoint(step, checkpoint = {}) {
-    return { ok: true, step, checkpoint };
-  }
-
-  async completeTask(result = {}) {
-    this.claimedTaskId = '';
-    return { ok: true, result };
-  }
-}
-
-const runtime = new FakeWorkerRuntime();
-installGitHubIssuesWorkerRuntime(runtime);
-const registered = await runtime.start();
-const claimed = await runtime.claimNextTask();
-const checkpoint = await runtime.checkpoint('github.issue.sync', { attempt: 1 });
-const completed = await runtime.completeTask({ success: true });
-
-if (registered.workerId !== 'worker-gh') throw new Error('worker register smoke failed');
-if (claimed.id !== 'task-gh-1') throw new Error('task claim smoke failed');
-if (checkpoint.step !== 'github.issue.sync') throw new Error('checkpoint smoke failed');
-if (!completed.ok) throw new Error('complete smoke failed');
-
-process.stdout.write(JSON.stringify({ ok: true, registered, claimed, checkpoint, completed }, null, 2) + '\n');

scripts/smoke-triage-fixtures.mjs

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import process from 'node:process';
-
-const packageRoot = path.resolve(process.cwd());
-const repoRoot = path.resolve(packageRoot, '..', '..', '..');
-
-const fixtureOnePath = path.join(repoRoot, 'Docs', 'operations', 'phase22-github-issue-opened.fixture.json');
-const fixtureTwoPath = path.join(repoRoot, 'Docs', 'operations', 'phase22-github-issue-opened.replay.fixture.json');
-
-const triageModule = await import(path.join(packageRoot, 'dist', 'src', 'triage.js'));
-const queueModule = await import(path.join(packageRoot, 'dist', 'src', 'queue-state.js'));
-
-const {
-  TriageEnqueueSchema,
-  buildDeliveryKey,
-  buildIssueKey,
-  routeIssueTriage,
-} = triageModule;
-
-const { ISSUE_QUEUE_STATE } = queueModule;
-
-const rowByDelivery = new Map();
-const rowByIssueKey = new Map();
-
-function enqueue(payload) {
-  const input = TriageEnqueueSchema.parse(payload);
-  const deliveryId = buildDeliveryKey(input);
-  const issueKey = buildIssueKey(input.repo, input.issueNumber);
-  const route = routeIssueTriage(input.labels || [], input.title, input.body || '');
-
-  if (rowByDelivery.has(deliveryId)) {
-    return {
-      created: false,
-      deduplicatedBy: 'delivery_id',
-      queueState: rowByDelivery.get(deliveryId).queueState,
-      deliveryId,
-      issueKey,
-      route,
-    };
-  }
-
-  if (rowByIssueKey.has(issueKey)) {
-    const existing = rowByIssueKey.get(issueKey);
-    existing.deliveryIds.push(deliveryId);
-    rowByDelivery.set(deliveryId, existing);
-    return {
-      created: false,
-      deduplicatedBy: 'issue_key',
-      queueState: existing.queueState,
-      deliveryId,
-      issueKey,
-      route,
-    };
-  }
-
-  const row = {
-    issueKey,
-    deliveryIds: [deliveryId],
-    queueState: ISSUE_QUEUE_STATE.queued,
-    assignedTeam: input.assignedTeam || route.assignedTeam,
-    route,
-  };
-  rowByDelivery.set(deliveryId, row);
-  rowByIssueKey.set(issueKey, row);
-  return {
-    created: true,
-    deduplicatedBy: null,
-    queueState: row.queueState,
-    deliveryId,
-    issueKey,
-    route,
-  };
-}
-
-const first = enqueue(JSON.parse(await readFile(fixtureOnePath, 'utf8')));
-const replay = enqueue(JSON.parse(await readFile(fixtureTwoPath, 'utf8')));
-
-if (!first.created) throw new Error('expected first fixture to create queue row');
-if (replay.created || replay.deduplicatedBy !== 'delivery_id') throw new Error('expected replay fixture to deduplicate by delivery_id');
-if (rowByIssueKey.size !== 1) throw new Error(`expected exactly one queue row, got ${rowByIssueKey.size}`);
-
-process.stdout.write(JSON.stringify({ ok: true, createdRows: rowByIssueKey.size, first, replay, finalRow: [...rowByIssueKey.values()][0] }, null, 2) + '\n');

src/a2a-http.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
 import type { GitHubAgentAction } from './runtime.js';
+import { listGitHubAppWebhookPaths, routeGitHubWebhook } from './github-app-routing.js';
 import { buildAgentCard, resolveTemplateAgentConfig, TEMPLATE_AGENT_ID, TEMPLATE_AGENT_NAME } from './metadata.js';
 import { executeGitHubAgentAction } from './runtime.js';
 
@@ -24,18 +25,28 @@ export function createTemplateAgentHttpServer() {
 }
 
 async function handleRequest(request: IncomingMessage, response: ServerResponse, baseUrl: string) {
+  const routePath = normalizePath(request.url || '/');
   if (request.method === 'GET' && request.url === '/health') return sendJson(response, 200, { ok: true, agent: TEMPLATE_AGENT_ID });
   if (request.method === 'GET' && request.url === '/') return sendHtml(response, 200, `<html><body><h1>${TEMPLATE_AGENT_NAME}</h1></body></html>`);
   if (request.method === 'GET' && (request.url === '/.well-known/agent-card.json' || request.url === '/.well-known/agent.json')) {
     return sendJson(response, 200, buildAgentCard(baseUrl));
   }
+  const configuredWebhookPaths = request.method === 'POST' ? await listGitHubAppWebhookPaths() : [];
+  if (request.method === 'POST' && configuredWebhookPaths.some((configuredPath) => routePath === configuredPath || routePath.startsWith(`${configuredPath}/`))) {
+    const rawBody = await readRawBody(request);
+    const payload = rawBody.trim() ? JSON.parse(rawBody) : {};
+    const result = await routeGitHubWebhook({
+      payload,
+      rawBody,
+      routePath,
+      signature256: readHeader(request, 'x-hub-signature-256'),
+      eventName: readHeader(request, 'x-github-event'),
+      deliveryId: readHeader(request, 'x-github-delivery'),
+    });
+    return sendJson(response, result.ok ? 200 : 400, result);
+  }
   if (request.method === 'POST' && request.url === '/a2a/v1') {
     const rpc = ((await readJson(request)) || {}) as RpcRequest;
-    if (rpc && typeof rpc === 'object' && 'action' in rpc && typeof (rpc as { action?: unknown }).action === 'string') {
-      const action = rpc as unknown as GitHubAgentAction;
-      const result = await executeGitHubAgentAction(action);
-      return sendJson(response, 200, { ok: true, agent: TEMPLATE_AGENT_ID, action: action.action, result });
-    }
     if (rpc.method === 'agent/getCard') return sendJson(response, 200, { jsonrpc: '2.0', id: rpc.id ?? null, result: buildAgentCard(baseUrl) });
     if (rpc.method === 'message/send') {
       const action = parseAction((rpc.params?.message as { parts?: Array<{ text?: string }> } | undefined)?.parts?.map((part) => part.text || '').join(' ').trim() || '');
@@ -76,10 +87,23 @@ function parseAction(text: string): GitHubAgentAction {
 }
 
 async function readJson(request: IncomingMessage) {
+  const raw = (await readRawBody(request)).trim();
+  return raw ? JSON.parse(raw) : null;
+}
+
+async function readRawBody(request: IncomingMessage) {
   const chunks: Buffer[] = [];
   for await (const chunk of request) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-  const raw = Buffer.concat(chunks).toString('utf8').trim();
-  return raw ? JSON.parse(raw) : null;
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+function readHeader(request: IncomingMessage, name: string) {
+  const value = request.headers[name];
+  return typeof value === 'string' ? value : Array.isArray(value) ? value.join(',') : undefined;
+}
+
+function normalizePath(url: string) {
+  return url.split('?', 1)[0] || '/';
 }
 
 function sendJson(response: ServerResponse, statusCode: number, payload: unknown) {

src/cli.ts

@@ -5,22 +5,11 @@ import { resolve } from 'node:path';
 import { createTemplateAgentHttpServer } from './a2a-http.js';
 import { runMcpServer } from './mcp-server.js';
 import { executeGitHubAgentAction } from './runtime.js';
-import { GitHubIssuesRoom13WorkerRuntime, installGitHubIssuesWorkerRuntime } from './room13-worker.js';
 
 const cmd = process.argv[2];
 
 if (cmd === 'serve-a2a') {
-  createTemplateAgentHttpServer().start().then(async () => {
-    const room13Worker = new GitHubIssuesRoom13WorkerRuntime('sin-github-issues');
-    installGitHubIssuesWorkerRuntime(room13Worker);
-    await room13Worker.start().catch(() => undefined);
-    const stop = async () => {
-      await room13Worker.stop().catch(() => undefined);
-      process.exit(0);
-    };
-    process.once('SIGINT', () => void stop());
-    process.once('SIGTERM', () => void stop());
-  }).catch(err => {
+  createTemplateAgentHttpServer().start().catch(err => {
     console.error(err);
     process.exit(1);
   });

src/github-app-routing.ts

@@ -0,0 +1,364 @@
+import { createHmac, createPrivateKey, createSign, timingSafeEqual } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+
+type JsonObject = Record<string, unknown>;
+
+export type GitHubAppRouteRecord = {
+  agentSlug: string;
+  botName?: string;
+  appId: number;
+  clientId?: string;
+  appSlug?: string;
+  routePath?: string;
+  privateKeyPem?: string;
+  privateKeyPath?: string;
+  privateKeyEnv?: string;
+  webhookSecret?: string;
+  webhookSecretPath?: string;
+  webhookSecretEnv?: string;
+};
+
+type GitHubAppRoutingConfig = {
+  defaultMode?: 'central' | 'path' | 'hybrid';
+  defaultWebhookPath?: string;
+  apps: GitHubAppRouteRecord[];
+};
+
+type WebhookRouteInput = {
+  payload?: unknown;
+  rawBody?: string;
+  routePath?: string;
+  signature256?: string;
+  eventName?: string;
+  deliveryId?: string;
+};
+
+type CommentAsAppInput = {
+  repo: string;
+  issueNumber: number;
+  body: string;
+  agentSlug?: string;
+  appId?: number;
+  installationId: number;
+};
+
+const GITHUB_API_BASE = String(process.env.SIN_GITHUB_API_BASE_URL || 'https://api.github.com').trim() || 'https://api.github.com';
+const GITHUB_API_VERSION = '2022-11-28';
+
+export async function getGitHubAppRoutingStatus() {
+  const config = await loadGitHubAppRoutingConfig();
+  const configuredApps = await Promise.all(
+    config.apps.map(async (app) => {
+      const privateKeyResolved = Boolean(await readPrivateKey(app));
+      const webhookSecretResolved = Boolean(await readWebhookSecret(app));
+      return {
+        agentSlug: app.agentSlug,
+        appSlug: app.appSlug || null,
+        botName: app.botName || `${app.agentSlug}[bot]`,
+        appId: app.appId,
+        clientId: app.clientId || null,
+        routePath: app.routePath || `${config.defaultWebhookPath || '/github/webhook'}/${app.agentSlug}`,
+        privateKeyRefConfigured: Boolean(app.privateKeyPem || app.privateKeyPath || app.privateKeyEnv),
+        privateKeyResolved,
+        webhookSecretRefConfigured: Boolean(app.webhookSecret || app.webhookSecretPath || app.webhookSecretEnv),
+        webhookSecretResolved,
+      };
+    }),
+  );
+  return {
+    ok: true,
+    defaultMode: config.defaultMode || 'hybrid',
+    defaultWebhookPath: config.defaultWebhookPath || '/github/webhook',
+    configuredApps,
+  };
+}
+
+export async function listGitHubAppWebhookPaths() {
+  const config = await loadGitHubAppRoutingConfig();
+  const paths = new Set<string>();
+  paths.add(config.defaultWebhookPath || '/github/webhook');
+  for (const app of config.apps) {
+    if (app.routePath) paths.add(normalizeRoutePath(app.routePath));
+  }
+  return [...paths];
+}
+
+export async function routeGitHubWebhook(input: WebhookRouteInput) {
+  const config = await loadGitHubAppRoutingConfig();
+  const payload = parsePayload(input.payload, input.rawBody);
+  const installation = asObject(payload.installation);
+  const installationId = parseInteger(installation?.id);
+  const appId = parseInteger(installation?.app_id);
+  const routePath = normalizeRoutePath(input.routePath || config.defaultWebhookPath || '/github/webhook');
+  const matchedApp = resolveRoute(config, { appId, routePath });
+
+  if (!matchedApp) {
+    return {
+      ok: false,
+      error: 'github_app_route_not_found',
+      routePath,
+      appId,
+      installationId,
+      configuredAppIds: config.apps.map((app) => app.appId),
+    };
+  }
+
+  const verification = await verifyWebhookSignature(matchedApp, input.signature256, input.rawBody || '');
+  if (!verification.ok) {
+    return {
+      ok: false,
+      error: verification.error,
+      routePath,
+      appId,
+      installationId,
+      agentSlug: matchedApp.agentSlug,
+      botName: matchedApp.botName || `${matchedApp.agentSlug}[bot]`,
+    };
+  }
+
+  const repository = asObject(payload.repository);
+  return {
+    ok: true,
+    route: {
+      agentSlug: matchedApp.agentSlug,
+      botName: matchedApp.botName || `${matchedApp.agentSlug}[bot]`,
+      appId: matchedApp.appId,
+      installationId,
+      routePath: matchedApp.routePath || `${config.defaultWebhookPath || '/github/webhook'}/${matchedApp.agentSlug}`,
+    },
+    event: {
+      name: input.eventName || null,
+      deliveryId: input.deliveryId || null,
+      action: typeof payload.action === 'string' ? payload.action : null,
+      repository: typeof repository?.full_name === 'string' ? repository.full_name : null,
+    },
+    verification: {
+      signatureChecked: Boolean(input.signature256),
+      signatureValid: verification.signatureValid,
+    },
+  };
+}
+
+export async function commentIssueAsGitHubApp(input: CommentAsAppInput) {
+  const config = await loadGitHubAppRoutingConfig();
+  const matchedApp = resolveCommentRoute(config, input);
+  if (!matchedApp) {
+    throw new Error(`github_app_route_not_found:${input.agentSlug || input.appId || 'unknown'}`);
+  }
+
+  const privateKey = await readPrivateKey(matchedApp);
+  if (!privateKey) {
+    throw new Error(`github_app_private_key_missing:${matchedApp.agentSlug}`);
+  }
+
+  const jwt = createGitHubAppJwt(matchedApp.appId, privateKey);
+  const tokenPayload = await githubApiJson<{ token?: string; expires_at?: string }>(
+    `${GITHUB_API_BASE}/app/installations/${input.installationId}/access_tokens`,
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': GITHUB_API_VERSION,
+      },
+      body: '{}',
+    },
+  );
+
+  if (!tokenPayload.token) {
+    throw new Error(`github_app_installation_token_missing:${matchedApp.agentSlug}`);
+  }
+
+  const commentPayload = await githubApiJson<{ html_url?: string; id?: number }>(
+    `${GITHUB_API_BASE}/repos/${input.repo}/issues/${input.issueNumber}/comments`,
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${tokenPayload.token}`,
+        Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': GITHUB_API_VERSION,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ body: input.body }),
+    },
+  );
+
+  return {
+    ok: true,
+    repo: input.repo,
+    issueNumber: input.issueNumber,
+    appId: matchedApp.appId,
+    agentSlug: matchedApp.agentSlug,
+    botName: matchedApp.botName || `${matchedApp.agentSlug}[bot]`,
+    installationId: input.installationId,
+    commentId: commentPayload.id || null,
+    commentUrl: commentPayload.html_url || null,
+    tokenExpiresAt: tokenPayload.expires_at || null,
+  };
+}
+
+async function loadGitHubAppRoutingConfig(): Promise<GitHubAppRoutingConfig> {
+  const inlineJson = String(process.env.SIN_GITHUB_APP_ROUTING_JSON || '').trim();
+  const configPath = String(process.env.SIN_GITHUB_APP_ROUTING_PATH || '').trim();
+
+  let parsed: unknown = { apps: [] };
+  if (inlineJson) {
+    parsed = JSON.parse(inlineJson);
+  } else if (configPath) {
+    parsed = JSON.parse(await readFile(configPath, 'utf8'));
+  }
+
+  const asConfig = asObject(parsed) || { apps: [] };
+  const apps = Array.isArray(asConfig.apps)
+    ? asConfig.apps
+        .map((entry) => normalizeAppRecord(entry))
+        .filter((entry): entry is GitHubAppRouteRecord => Boolean(entry))
+    : [];
+
+  return {
+    defaultMode: parseMode(asConfig.defaultMode ?? asConfig.mode),
+    defaultWebhookPath: typeof asConfig.defaultWebhookPath === 'string' ? normalizeRoutePath(asConfig.defaultWebhookPath) : '/github/webhook',
+    apps,
+  };
+}
+
+function normalizeAppRecord(value: unknown): GitHubAppRouteRecord | null {
+  const entry = asObject(value);
+  if (!entry) return null;
+  const agentSlug = firstNonEmptyString(entry.agentSlug, entry.preferredAgentSlug, entry.appSlug);
+  const appId = parseInteger(entry.appId) ?? parseInteger(resolveEnvString(entry.appIdEnv));
+  if (!agentSlug || !appId) return null;
+  const routePath = firstNonEmptyString(entry.routePath, entry.webhookPath);
+  return {
+    agentSlug,
+    appSlug: firstNonEmptyString(entry.appSlug) || undefined,
+    botName: typeof entry.botName === 'string' ? entry.botName.trim() : undefined,
+    appId,
+    clientId: firstNonEmptyString(entry.clientId, resolveEnvString(entry.clientIdEnv)) || undefined,
+    routePath: routePath ? normalizeRoutePath(routePath) : undefined,
+    privateKeyPem: typeof entry.privateKeyPem === 'string' ? entry.privateKeyPem : undefined,
+    privateKeyPath: typeof entry.privateKeyPath === 'string' ? entry.privateKeyPath.trim() : undefined,
+    privateKeyEnv: firstNonEmptyString(entry.privateKeyEnv) || undefined,
+    webhookSecret: typeof entry.webhookSecret === 'string' ? entry.webhookSecret : undefined,
+    webhookSecretPath: typeof entry.webhookSecretPath === 'string' ? entry.webhookSecretPath.trim() : undefined,
+    webhookSecretEnv: firstNonEmptyString(entry.webhookSecretEnv) || undefined,
+  };
+}
+
+function parsePayload(payload: unknown, rawBody?: string) {
+  if (payload && typeof payload === 'object') return payload as JsonObject;
+  if (rawBody?.trim()) return JSON.parse(rawBody) as JsonObject;
+  return {} as JsonObject;
+}
+
+function resolveRoute(config: GitHubAppRoutingConfig, input: { appId: number | null; routePath: string }) {
+  if (input.appId) {
+    const byAppId = config.apps.find((app) => app.appId === input.appId);
+    if (byAppId) return byAppId;
+  }
+  const matchesByPath = config.apps.filter((app) => app.routePath && normalizeRoutePath(app.routePath) === input.routePath);
+  if (matchesByPath.length === 1) return matchesByPath[0] || null;
+  return null;
+}
+
+function resolveCommentRoute(config: GitHubAppRoutingConfig, input: CommentAsAppInput) {
+  if (input.appId) {
+    return config.apps.find((app) => app.appId === input.appId) || null;
+  }
+  if (input.agentSlug) {
+    return config.apps.find((app) => app.agentSlug === input.agentSlug) || null;
+  }
+  return null;
+}
+
+async function verifyWebhookSignature(app: GitHubAppRouteRecord, signature256: string | undefined, rawBody: string) {
+  if (!signature256) {
+    return { ok: true, signatureValid: false };
+  }
+  const secret = await readWebhookSecret(app);
+  if (!secret) {
+    return { ok: false, signatureValid: false, error: `github_app_webhook_secret_missing:${app.agentSlug}` };
+  }
+  const expected = `sha256=${createHmac('sha256', secret).update(rawBody).digest('hex')}`;
+  const valid = safeEqual(expected, signature256.trim());
+  return valid
+    ? { ok: true, signatureValid: true }
+    : { ok: false, signatureValid: false, error: 'github_app_webhook_signature_invalid' };
+}
+
+async function readPrivateKey(app: GitHubAppRouteRecord) {
+  if (app.privateKeyPem?.trim()) return app.privateKeyPem.trim();
+  if (app.privateKeyEnv && process.env[app.privateKeyEnv]?.trim()) return String(process.env[app.privateKeyEnv]).trim();
+  if (app.privateKeyPath?.trim()) return (await readFile(app.privateKeyPath, 'utf8')).trim();
+  return null;
+}
+
+async function readWebhookSecret(app: GitHubAppRouteRecord) {
+  if (app.webhookSecret?.trim()) return app.webhookSecret.trim();
+  if (app.webhookSecretEnv && process.env[app.webhookSecretEnv]?.trim()) return String(process.env[app.webhookSecretEnv]).trim();
+  if (app.webhookSecretPath?.trim()) return (await readFile(app.webhookSecretPath, 'utf8')).trim();
+  return null;
+}
+
+function createGitHubAppJwt(appId: number, privateKeyPem: string) {
+  const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
+  const now = Math.floor(Date.now() / 1000);
+  const payload = Buffer.from(JSON.stringify({ iat: now - 60, exp: now + 540, iss: appId })).toString('base64url');
+  const signingInput = `${header}.${payload}`;
+  const signer = createSign('RSA-SHA256');
+  signer.update(signingInput);
+  signer.end();
+  const signature = signer.sign(createPrivateKey(privateKeyPem), 'base64url');
+  return `${signingInput}.${signature}`;
+}
+
+async function githubApiJson<T>(url: string, init: RequestInit): Promise<T> {
+  const response = await fetch(url, init);
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(`github_api_request_failed:${response.status}:${text.slice(0, 500)}`);
+  }
+  return text ? (JSON.parse(text) as T) : ({} as T);
+}
+
+function parseMode(value: unknown): 'central' | 'path' | 'hybrid' | undefined {
+  if (value === 'central' || value === 'path' || value === 'hybrid') return value;
+  if (value === 'central-endpoint-routing') return 'central';
+  if (value === 'path-routing') return 'path';
+  if (value === 'hybrid-routing') return 'hybrid';
+  return undefined;
+}
+
+function normalizeRoutePath(value: string) {
+  const clean = value.split('?', 1)[0].trim();
+  return clean.startsWith('/') ? clean : `/${clean}`;
+}
+
+function parseInteger(value: unknown) {
+  const parsed = Number.parseInt(String(value ?? '').trim(), 10);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function asObject(value: unknown): JsonObject | null {
+  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JsonObject) : null;
+}
+
+function safeEqual(left: string, right: string) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) return false;
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+function firstNonEmptyString(...values: unknown[]) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+function resolveEnvString(envKey: unknown) {
+  if (typeof envKey !== 'string' || !envKey.trim()) return null;
+  const value = process.env[envKey.trim()];
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}

src/hf_sync.ts

@@ -1,86 +0,0 @@
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as tar from 'tar';
-import { uploadFile, downloadFile } from '@huggingface/hub';
-import cron from 'node-cron';
-
-const AUTH_DIR = path.join(process.cwd(), '.wwebjs_auth');
-const BACKUP_FILE = path.join(process.cwd(), 'auth_backup.tar.gz');
-
-const hfToken = process.env.HF_TOKEN;
-const datasetRepo = process.env.HF_DATASET_REPO;
-
-export async function backupAuthSession(): Promise<void> {
-  if (!hfToken || !datasetRepo) {
-    return;
-  }
-
-  if (!fs.existsSync(AUTH_DIR)) {
-    return;
-  }
-
-  try {
-    await tar.c({ gzip: true, file: BACKUP_FILE, cwd: process.cwd() }, ['.wwebjs_auth']);
-
-    const fileBuffer = fs.readFileSync(BACKUP_FILE);
-    const blob = new Blob([fileBuffer], { type: 'application/gzip' });
-
-    await uploadFile({
-      repo: { type: 'dataset', name: datasetRepo },
-      credentials: { accessToken: hfToken },
-      file: {
-        path: 'auth_backup.tar.gz',
-        content: blob
-      },
-      commitTitle: 'Auto-Backup: Session - ' + new Date().toISOString()
-    });
-  } catch (error) {
-    console.error('[HF-Sync] Error during backup:', error);
-  }
-}
-
-export async function restoreAuthSession(): Promise<void> {
-  if (!hfToken || !datasetRepo) {
-    return;
-  }
-
-  try {
-    const response = await downloadFile({
-      repo: { type: 'dataset', name: datasetRepo },
-      credentials: { accessToken: hfToken },
-      path: 'auth_backup.tar.gz'
-    });
-
-    if (!response) {
-      return;
-    }
-
-    const buffer = await response.arrayBuffer();
-    fs.writeFileSync(BACKUP_FILE, Buffer.from(buffer));
-    
-    await tar.x({ file: BACKUP_FILE, cwd: process.cwd() });
-    console.log('[HF-Sync] Restored session from dataset.');
-  } catch (error: any) {
-    if (!error.message?.includes('404')) {
-      console.error('[HF-Sync] Restore error:', error);
-    }
-  }
-}
-
-export function startKeepAlivePing(): void {
-  const spaceUrl = process.env.SPACE_HOST ? 'https://' + process.env.SPACE_HOST : 'http://localhost:' + (process.env.PORT || 7860);
-  
-  cron.schedule('*/5 * * * *', async () => {
-    try {
-      await fetch(spaceUrl);
-    } catch (e) {
-      // ignore
-    }
-  });
-}
-
-export function startAutoBackup(): void {
-  cron.schedule('*/10 * * * *', async () => {
-    await backupAuthSession();
-  });
-}

src/idle-monetization.ts

@@ -1,33 +0,0 @@
-/**
- * 💸 IDLE WORKFORCE & MONETIZATION DIRECTIVE (PRIORITY 0001) 🚨
- * NEVER IDLE MANDATE: This A2A sits NEVER simply dumb around.
- * If no task exists, it autonomously seeks out work, bug bounties, surveys, or freelance gigs.
- */
-
-export function startAutonomousIdleLoop() {
-  console.log('💸 Autonomous Monetization & Hacking loop enabled (Mega Krass Mode).');
-  const runtimeState = globalThis as typeof globalThis & { isAgentBusy?: boolean };
-
-  // The loop checks every 5 minutes if the agent is idle.
-  setInterval(async () => {
-    // Skip if currently busy with a user or fleet task
-    if (runtimeState.isAgentBusy) {
-      return;
-    }
-
-    console.log('\n[IDLE-LOOP] Agent has no tasks. Searching for autonomous opportunities...');
-    
-    const tasks = [
-      () => console.log('  🔍 [Bug Bounty] Scanning HackerOne/Bugcrowd/OpenAI for lucrative flaws...'),
-      () => console.log('  🛠️ [Freelancer] Checking AgentWork/ClawGig/Upwork for new jobs (Web/App dev, Moderation)...'),
-      () => console.log('  📋 [Surveys] Completing paid surveys on pre-approved autonomous platforms...'),
-      () => console.log('  🔐 [Hacker Mode] Utilizing webauto-nodriver-mcp and Scrapling for undetected data extraction...')
-    ];
-
-    // Pick a random idle task to pretend we are doing something useful
-    // In a real implementation, this would trigger actual A2A tasks (e.g. OpenAI completion).
-    const randomTask = tasks[Math.floor(Math.random() * tasks.length)];
-    randomTask();
-
-  }, 5 * 60 * 1000); // Every 5 minutes
-}

src/lib/telemetry/ZeroTrustAuth.ts

@@ -0,0 +1,62 @@
+import { verify } from 'jsonwebtoken';
+const createTemplateLogger = (runId?: string) => ({ failed: async (s: string, e: string, err: any) => console.error(s, e, err), log: async (o: any) => console.log(o), succeeded: async (s: string, e: string, o: any) => console.log(s, e, o) });
+import type { IncomingMessage } from 'node:http';
+
+// We fetch the public key (or use a shared secret if configured) from SIN-Authenticator's OIDC jwks endpoint or env
+const OIDC_PUBLIC_KEY = process.env.SIN_OIDC_PUBLIC_KEY || process.env.SIN_SHARED_SECRET || '';
+
+export type AuthContext = {
+  subject: string;
+  roles: string[];
+  claims: Record<string, unknown>;
+  isValid: boolean;
+  error?: string;
+};
+
+export async function verifyZeroTrustToken(request: IncomingMessage, runId?: string): Promise<AuthContext> {
+  const logger = createTemplateLogger(runId);
+  const authHeader = request.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    await logger.failed('auth.zero_trust', 'auth.token.missing', new Error('Missing or malformed Authorization header'));
+    return { subject: 'anonymous', roles: [], claims: {}, isValid: false, error: 'missing_token' };
+  }
+
+  const token = authHeader.split(' ')[1];
+
+  if (!OIDC_PUBLIC_KEY) {
+    // If the fleet runs in a mode without strict OIDC enforcement configured yet,
+    // we log a warning but might fail closed depending on fleet policy.
+    // For Epic #195, we want to enforce zero-trust strictly when keys are present.
+    await logger.log({
+      surface: 'auth.zero_trust',
+      event: 'auth.keys.missing',
+      level: 'warn',
+      status: 'failed',
+      details: { note: 'No SIN_OIDC_PUBLIC_KEY or SIN_SHARED_SECRET configured for verification.' }
+    });
+    return { subject: 'anonymous', roles: [], claims: {}, isValid: false, error: 'missing_keys' };
+  }
+
+  try {
+    const decoded = verify(token, OIDC_PUBLIC_KEY, { algorithms: ['RS256', 'HS256'] }) as Record<string, unknown>;
+    
+    await logger.succeeded('auth.zero_trust', 'auth.token.verified', { subject: decoded.sub });
+    
+    return {
+      subject: String(decoded.sub || 'unknown'),
+      roles: Array.isArray(decoded.roles) ? decoded.roles.map(String) : [],
+      claims: decoded,
+      isValid: true
+    };
+  } catch (error) {
+    await logger.failed('auth.zero_trust', 'auth.token.rejected', error);
+    return { 
+      subject: 'anonymous', 
+      roles: [], 
+      claims: {}, 
+      isValid: false, 
+      error: error instanceof Error ? error.message : String(error) 
+    };
+  }
+}

src/mcp-server.ts

@@ -17,41 +17,40 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
         inputSchema: { type: 'object', properties: {} },
       },
       {
-        name: 'sin_github_worker_register',
-        description: 'Register the GitHub-Issues runtime as a Room-13 worker and claim its initial lease.',
+        name: 'sin_github_app_routing_status',
+        description: 'Inspect per-agent GitHub App routing config without exposing secrets.',
         inputSchema: { type: 'object', properties: {} },
       },
       {
-        name: 'sin_github_worker_status',
-        description: 'Inspect Room-13 worker registration and claim state for GitHub-Issues.',
-        inputSchema: { type: 'object', properties: {} },
-      },
-      {
-        name: 'sin_github_worker_claim_next',
-        description: 'Claim the next Room-13 task for GitHub-Issues.',
-        inputSchema: { type: 'object', properties: {} },
-      },
-      {
-        name: 'sin_github_worker_checkpoint',
-        description: 'Send a checkpoint to Room-13 for GitHub-Issues.',
+        name: 'sin_github_webhook_route',
+        description: 'Resolve a GitHub webhook payload to the correct specialized SIN coder app using installation.app_id and routing config.',
         inputSchema: {
           type: 'object',
           properties: {
-            step: { type: 'string' },
-            checkpoint: { type: 'object' }
+            payload: {},
+            rawBody: { type: 'string' },
+            routePath: { type: 'string' },
+            signature256: { type: 'string' },
+            eventName: { type: 'string' },
+            deliveryId: { type: 'string' },
           },
-          required: ['step']
-        }
+        },
       },
       {
-        name: 'sin_github_worker_complete',
-        description: 'Complete the currently claimed Room-13 task for GitHub-Issues.',
+        name: 'sin_github_issue_comment_as_app',
+        description: 'Post an issue or PR comment as the correct GitHub App identity using a JWT + installation token flow.',
         inputSchema: {
           type: 'object',
           properties: {
-            result: { type: 'object' }
-          }
-        }
+            repo: { type: 'string' },
+            issueNumber: { type: 'number' },
+            body: { type: 'string' },
+            agentSlug: { type: 'string' },
+            appId: { type: 'number' },
+            installationId: { type: 'number' },
+          },
+          required: ['repo', 'issueNumber', 'body', 'installationId'],
+        },
       },
       {
         name: 'sin_github_project_orchestrate',
@@ -77,64 +76,6 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ['prompt'],
         },
       },
-      {
-        name: 'sin_github_issue_ensure',
-        description: 'Create or update an issue by exact title match.',
-        inputSchema: {
-          type: 'object',
-          properties: {
-            repo: { type: 'string' },
-            title: { type: 'string' },
-            body: { type: 'string' },
-            labels: { type: 'array', items: { type: 'string' } }
-          },
-          required: ['repo', 'title', 'body']
-        }
-      },
-      {
-        name: 'sin_github_issue_comment',
-        description: 'Comment on a GitHub issue.',
-        inputSchema: {
-          type: 'object',
-          properties: {
-            repo: { type: 'string' },
-            issueNumber: { type: 'number' },
-            body: { type: 'string' }
-          },
-          required: ['repo', 'issueNumber', 'body']
-        }
-      },
-      {
-        name: 'sin_github_issue_close',
-        description: 'Close a GitHub issue with optional comment.',
-        inputSchema: {
-          type: 'object',
-          properties: {
-            repo: { type: 'string' },
-            issueNumber: { type: 'number' },
-            comment: { type: 'string' }
-          },
-          required: ['repo', 'issueNumber']
-        }
-      },
-      {
-        name: 'sin_github_issue_triage_enqueue',
-        description: 'Durably enqueue a GitHub issue triage event into the coder dispatch pool.',
-        inputSchema: {
-          type: 'object',
-          properties: {
-            repo: { type: 'string' },
-            issueNumber: { type: 'number' },
-            title: { type: 'string' },
-            body: { type: 'string' },
-            labels: { type: 'array', items: { type: 'string' } },
-            assignedTeam: { type: 'string' },
-            deliveryId: { type: 'string' },
-            eventAction: { type: 'string' }
-          },
-          required: ['repo', 'issueNumber', 'title']
-        }
-      },
       {
         name: 'sin_github_wiki_sync',
         description: 'Update the repository Wiki with project documentation.',
@@ -195,9 +136,31 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ['prNumber'],
         },
       },
+      {
+        name: 'sin_github_issue_pool_enqueue',
+        description: 'Insert an issue into the Hermes issue pool for Team-Coding dispatch.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            repoName: { type: 'string' },
+            issueNumber: { type: 'number' },
+            title: { type: 'string' },
+            body: { type: 'string' },
+            labels: { type: 'array', items: { type: 'string' } },
+            issueUrl: { type: 'string' },
+            assignedTeam: { type: 'string' },
+            assignedAgent: { type: 'string' },
+            status: { type: 'string' },
+            state: { type: 'string' },
+            routingStrategy: { type: 'string' },
+            fanoutPlan: { type: 'array', items: {} },
+          },
+          required: ['repoName', 'issueNumber', 'title'],
+        },
+      },
       {
         name: 'sin_github_ledger_log',
-        description: 'Publish an agent activity log or achievement to the public OpenSolver-Ledger showcase repository.',
+        description: 'Publish an agent activity log or achievement to the public OpenSIN-Ledger showcase repository.',
         inputSchema: {
           type: 'object',
           properties: {
@@ -217,53 +180,41 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     let action: GitHubAgentAction;
     const args = request.params.arguments as any;
 
-      switch (request.params.name) {
-        case 'sin_github_health':
-          action = { action: 'sin.github.health' };
-          break;
-        case 'sin_github_worker_register':
-          action = { action: 'sin.github.worker.register' };
-          break;
-        case 'sin_github_worker_status':
-          action = { action: 'sin.github.worker.status' };
-          break;
-        case 'sin_github_worker_claim_next':
-          action = { action: 'sin.github.worker.claim_next' };
-          break;
-        case 'sin_github_worker_checkpoint':
-          action = { action: 'sin.github.worker.checkpoint', step: args.step, checkpoint: args.checkpoint };
-          break;
-        case 'sin_github_worker_complete':
-          action = { action: 'sin.github.worker.complete', result: args.result };
-          break;
-        case 'sin_github_project_orchestrate':
-          action = { action: 'sin.github.project.orchestrate', prompt: args.prompt, contextDir: args.contextDir };
-          break;
-      case 'sin_github_issue_manage':
-        action = { action: 'sin.github.issue.manage', prompt: args.prompt, issueNumber: args.issueNumber };
-        break;
-      case 'sin_github_issue_ensure':
-        action = { action: 'sin.github.issue.ensure', repo: args.repo, title: args.title, body: args.body, labels: args.labels };
+    switch (request.params.name) {
+      case 'sin_github_health':
+        action = { action: 'sin.github.health' };
         break;
-      case 'sin_github_issue_comment':
-        action = { action: 'sin.github.issue.comment', repo: args.repo, issueNumber: args.issueNumber, body: args.body };
+      case 'sin_github_app_routing_status':
+        action = { action: 'sin.github.app.routing.status' };
         break;
-      case 'sin_github_issue_close':
-        action = { action: 'sin.github.issue.close', repo: args.repo, issueNumber: args.issueNumber, comment: args.comment };
+      case 'sin_github_webhook_route':
+        action = {
+          action: 'sin.github.webhook.route',
+          payload: args.payload,
+          rawBody: args.rawBody,
+          routePath: args.routePath,
+          signature256: args.signature256,
+          eventName: args.eventName,
+          deliveryId: args.deliveryId,
+        };
         break;
-      case 'sin_github_issue_triage_enqueue':
+      case 'sin_github_issue_comment_as_app':
         action = {
-          action: 'sin.github.issue.triage.enqueue',
+          action: 'sin.github.issue.comment.as_app',
           repo: args.repo,
           issueNumber: args.issueNumber,
-          title: args.title,
           body: args.body,
-          labels: args.labels,
-          assignedTeam: args.assignedTeam,
-          deliveryId: args.deliveryId,
-          eventAction: args.eventAction
+          agentSlug: args.agentSlug,
+          appId: args.appId,
+          installationId: args.installationId,
         };
         break;
+      case 'sin_github_project_orchestrate':
+        action = { action: 'sin.github.project.orchestrate', prompt: args.prompt, contextDir: args.contextDir };
+        break;
+      case 'sin_github_issue_manage':
+        action = { action: 'sin.github.issue.manage', prompt: args.prompt, issueNumber: args.issueNumber };
+        break;
       case 'sin_github_wiki_sync':
         action = { action: 'sin.github.wiki.sync', prompt: args.prompt, contextDir: args.contextDir };
         break;
@@ -279,6 +230,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       case 'sin_github_pr_review':
         action = { action: 'sin.github.pr.review', prNumber: args.prNumber, contextDir: args.contextDir };
         break;
+      case 'sin_github_issue_pool_enqueue':
+        action = {
+          action: 'sin.github.issue.pool.enqueue',
+          repoName: args.repoName,
+          issueNumber: args.issueNumber,
+          title: args.title,
+          body: args.body,
+          labels: args.labels,
+          issueUrl: args.issueUrl,
+          assignedTeam: args.assignedTeam,
+          assignedAgent: args.assignedAgent,
+          status: args.status,
+          state: args.state,
+          routingStrategy: args.routingStrategy,
+          fanoutPlan: args.fanoutPlan,
+        };
+        break;
       case 'sin_github_ledger_log':
         action = { action: 'sin.github.ledger.log', agentName: args.agentName, activityTitle: args.activityTitle, details: args.details };
         break;
@@ -301,5 +269,5 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 export async function runMcpServer() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error('AZA-SIN-Coder-•-GitHub-Issues MCP Server running on stdio');
+  console.error('A2A-SIN-GitHub-Issues MCP Server running on stdio');
 }

src/metadata.ts

@@ -1,8 +1,8 @@
 import process from 'node:process';
 
 export const TEMPLATE_AGENT_ID = 'sin-github-issues';
-export const TEMPLATE_AGENT_NAME = 'AZA-SIN-Coder-•-GitHub-Issues';
-export const TEMPLATE_AGENT_DESCRIPTION = 'CEO Elite GitHub issue triage and delegation architect for the AZA coding fleet — orchestrates issue lifecycle, comments, queueing, Projects V2, Discussions, Gists, Security audits, PR reviews, and public Showcase Ledger logging.';
+export const TEMPLATE_AGENT_NAME = 'SIN-GitHub-Issues';
+export const TEMPLATE_AGENT_DESCRIPTION = 'CEO Elite GitHub Operations Architect — orchestrates Projects V2, Issues, Wikis, Discussions, Gists, Security audits, PR Reviews, and public Showcase Ledger logging.';
 export const TEMPLATE_AGENT_VERSION = '2026.03.22';
 export const TEMPLATE_AGENT_DEFAULT_HOST = '127.0.0.1';
 export const TEMPLATE_AGENT_DEFAULT_PORT = 46031;
@@ -14,29 +14,19 @@ export const TEMPLATE_AGENT_SKILLS = [
     description: 'Check 2026 Elite GitHub Operations Architect readiness, model, and capabilities.',
   },
   {
-    id: 'sin.github.worker.register',
-    name: 'Worker Register',
-    description: 'Register the GitHub-Issues runtime as a Room-13 worker and claim its initial lease.',
+    id: 'sin.github.app.routing.status',
+    name: 'GitHub App Routing Status',
+    description: 'Inspect the configured multi-app GitHub routing table, route paths, and secret readiness without exposing credentials.',
   },
   {
-    id: 'sin.github.worker.status',
-    name: 'Worker Status',
-    description: 'Inspect GitHub-Issues worker registration and claim state against Room-13.',
+    id: 'sin.github.webhook.route',
+    name: 'GitHub Webhook Route',
+    description: 'Route GitHub webhook payloads to the correct SIN coder agent using installation.app_id, route path, and signature verification.',
   },
   {
-    id: 'sin.github.worker.claim_next',
-    name: 'Worker Claim Next',
-    description: 'Claim the next dispatchable Room-13 task for GitHub-Issues.',
-  },
-  {
-    id: 'sin.github.worker.checkpoint',
-    name: 'Worker Checkpoint',
-    description: 'Send checkpoint progress for the current Room-13 task.',
-  },
-  {
-    id: 'sin.github.worker.complete',
-    name: 'Worker Complete',
-    description: 'Mark the currently claimed Room-13 task as completed.',
+    id: 'sin.github.issue.comment.as_app',
+    name: 'Issue Comment As App',
+    description: 'Generate the correct GitHub App JWT and installation token, then post an issue or PR comment as the matched bot identity.',
   },
   {
     id: 'sin.github.project.orchestrate',
@@ -73,10 +63,15 @@ export const TEMPLATE_AGENT_SKILLS = [
     name: 'PR Review',
     description: 'Review Pull Requests for architectural compliance, security, performance, and test coverage. Auto-approve and merge if 100% pass.',
   },
+  {
+    id: 'sin.github.issue.pool.enqueue',
+    name: 'Issue Pool Enqueue',
+    description: 'Insert GitHub issue metadata into `sin_issues_pool` for Hermes/Team-Coding dispatch.',
+  },
   {
     id: 'sin.github.ledger.log',
     name: 'Ledger Log',
-    description: 'Publish an agent activity log or achievement to the public Delqhi/OpenSolver-Ledger showcase repository.',
+    description: 'Publish an agent activity log or achievement to the public Delqhi/OpenSIN-Ledger showcase repository.',
   },
 ] as const;
 

src/queue-state.js

@@ -1,29 +0,0 @@
-export const ISSUE_QUEUE_STATE = {
-  received: 'received',
-  queued: 'queued',
-  claimed: 'claimed',
-  dispatched: 'dispatched',
-  accepted: 'accepted',
-  completed: 'completed',
-  failed: 'failed',
-  dead_letter: 'dead_letter',
-};
-
-export function isActiveQueueState(value) {
-  return ['received', 'queued', 'claimed', 'dispatched', 'accepted'].includes(String(value || ''));
-}
-
-export function queueStateForStatus(value) {
-  switch (String(value || '').toLowerCase()) {
-    case 'pending':
-      return ISSUE_QUEUE_STATE.queued;
-    case 'in_progress':
-      return ISSUE_QUEUE_STATE.claimed;
-    case 'completed':
-      return ISSUE_QUEUE_STATE.completed;
-    case 'failed':
-      return ISSUE_QUEUE_STATE.failed;
-    default:
-      return ISSUE_QUEUE_STATE.received;
-  }
-}

src/queue-state.ts

@@ -1,31 +0,0 @@
-export const ISSUE_QUEUE_STATE = {
-  received: 'received',
-  queued: 'queued',
-  claimed: 'claimed',
-  dispatched: 'dispatched',
-  accepted: 'accepted',
-  completed: 'completed',
-  failed: 'failed',
-  dead_letter: 'dead_letter',
-} as const;
-
-export type IssueQueueState = keyof typeof ISSUE_QUEUE_STATE;
-
-export function isActiveQueueState(value: string | null | undefined): boolean {
-  return ['received', 'queued', 'claimed', 'dispatched', 'accepted'].includes(String(value || ''));
-}
-
-export function queueStateForStatus(status: string | null | undefined): IssueQueueState {
-  switch (String(status || '').toLowerCase()) {
-    case 'pending':
-      return 'queued';
-    case 'in_progress':
-      return 'claimed';
-    case 'completed':
-      return 'completed';
-    case 'failed':
-      return 'failed';
-    default:
-      return 'received';
-  }
-}

src/room13-worker.ts

@@ -1,191 +0,0 @@
-import os from 'node:os';
-import process from 'node:process';
-
-type Room13WorkerRegisterResponse = {
-  id?: string;
-  lease_epoch?: number;
-};
-
-type Room13WorkerClaimResponse = {
-  claimed_task_id?: string | null;
-  lease_epoch?: number;
-  lease_expires_at?: string | null;
-  run_id?: string;
-};
-
-type Room13Task = {
-  id: string;
-  status: string;
-  assigned_worker?: string | null;
-  run_id?: string | null;
-};
-
-export type GitHubIssuesWorkerSnapshot = {
-  enabled: boolean;
-  workerName: string;
-  workerId: string;
-  runId: string;
-  claimedTaskId: string;
-  leaseEpoch: number;
-  leaseExpiresAt?: string;
-  baseUrl: string;
-};
-
-let currentRuntime: GitHubIssuesRoom13WorkerRuntime | null = null;
-
-export function getCurrentGitHubIssuesWorkerRuntime() {
-  return currentRuntime;
-}
-
-export class GitHubIssuesRoom13WorkerRuntime {
-  protected workerId = '';
-  protected leaseEpoch = 0;
-  protected claimedTaskId = '';
-  protected leaseExpiresAt?: string;
-  protected readonly workerName: string;
-  protected readonly baseUrl: string;
-  protected readonly bearerToken: string;
-  protected readonly runId: string;
-  protected heartbeatTimer?: NodeJS.Timeout;
-
-  constructor(workerName = 'sin-github-issues', baseUrl = process.env.ROOM13_COORDINATOR_URL || '') {
-    this.workerName = workerName;
-    this.baseUrl = baseUrl.replace(/\/$/, '');
-    this.bearerToken = String(process.env.ROOM13_BEARER_TOKEN || '').trim();
-    this.runId = `${workerName}:${process.pid}:${Date.now()}`;
-  }
-
-  get enabled() {
-    return Boolean(this.baseUrl);
-  }
-
-  snapshot(): GitHubIssuesWorkerSnapshot {
-    return {
-      enabled: this.enabled,
-      workerName: this.workerName,
-      workerId: this.workerId,
-      runId: this.runId,
-      claimedTaskId: this.claimedTaskId,
-      leaseEpoch: this.leaseEpoch,
-      leaseExpiresAt: this.leaseExpiresAt,
-      baseUrl: this.baseUrl,
-    };
-  }
-
-  async start() {
-    if (!this.enabled) return this.snapshot();
-    const registered = await this.request<Room13WorkerRegisterResponse>('POST', '/api/workers', {
-      name: `${this.workerName}:${process.env.SPACE_HOST || 'local'}`,
-      type: 'general',
-      capabilities: ['platform:github', 'worker_runtime', 'lease_heartbeat', 'issue_lifecycle'],
-      metadata: { runtime: 'node', hostname: os.hostname() },
-      worker_identity: this.workerName,
-      persona_id: this.workerName,
-      platform: 'github-issues',
-      current_run_id: this.runId,
-      lease_ttl_sec: 120,
-      approval_state: 'idle',
-    });
-    this.workerId = String(registered?.id || '').trim();
-    this.leaseEpoch = Number(registered?.lease_epoch || 0);
-    if (this.workerId) {
-      const claim = await this.request<Room13WorkerClaimResponse>('POST', `/api/workers/${this.workerId}/claim`, {
-        run_id: this.runId,
-        ttl_sec: 120,
-      });
-      this.claimedTaskId = String(claim?.claimed_task_id || '').trim();
-      this.leaseEpoch = Number(claim?.lease_epoch || this.leaseEpoch || 0);
-      this.leaseExpiresAt = claim?.lease_expires_at || undefined;
-      this.startHeartbeatLoop();
-    }
-    return this.snapshot();
-  }
-
-  async stop() {
-    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-    if (!this.enabled || !this.workerId) return;
-    await this.request('POST', `/api/workers/${this.workerId}/release`, {
-      lease_epoch: this.leaseEpoch,
-      clear_run: true,
-      final_status: 'online',
-      status_reason: 'github_issues_runtime_stop',
-      approval_state: 'idle',
-    }).catch(() => undefined);
-  }
-
-  async heartbeat() {
-    if (!this.enabled || !this.workerId) return this.snapshot();
-    const result = await this.request<Room13WorkerClaimResponse>('POST', `/api/workers/${this.workerId}/heartbeat`, {
-      lease_epoch: this.leaseEpoch,
-      ttl_sec: 120,
-      metadata: {
-        run_id: this.runId,
-        claimed_task_id: this.claimedTaskId,
-        last_heartbeat_source: 'sin-github-issues',
-      },
-    });
-    this.leaseEpoch = Number(result?.lease_epoch || this.leaseEpoch || 0);
-    this.leaseExpiresAt = result?.lease_expires_at || this.leaseExpiresAt;
-    return this.snapshot();
-  }
-
-  async claimNextTask() {
-    if (!this.enabled || !this.workerId) throw new Error('room13_worker_not_registered');
-    const task = await this.request<Room13Task>('POST', '/api/tasks/claim-next', {
-      worker_id: this.workerId,
-      worker_identity: this.workerName,
-      accepted_types: ['github_issue_dispatch'],
-      min_priority: 'normal',
-      run_id: this.runId,
-      lease_epoch: this.leaseEpoch,
-    });
-    this.claimedTaskId = String(task?.id || '').trim();
-    return task;
-  }
-
-  async checkpoint(step: string, checkpoint: Record<string, unknown> = {}) {
-    if (!this.enabled || !this.workerId) throw new Error('room13_worker_not_registered');
-    return await this.request('POST', `/api/workers/${this.workerId}/checkpoint`, {
-      lease_epoch: this.leaseEpoch,
-      run_id: this.runId,
-      step,
-      checkpoint,
-    });
-  }
-
-  async completeTask(result: Record<string, unknown> = {}) {
-    if (!this.enabled || !this.claimedTaskId) throw new Error('room13_task_not_claimed');
-    const response = await this.request('PUT', `/api/tasks/${this.claimedTaskId}/complete`, result);
-    this.claimedTaskId = '';
-    return response;
-  }
-
-  private startHeartbeatLoop() {
-    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-    this.heartbeatTimer = setInterval(() => {
-      void this.heartbeat().catch(() => undefined);
-    }, 30000);
-    this.heartbeatTimer.unref();
-  }
-
-  private async request<T = unknown>(method: string, path: string, body?: unknown) {
-    const headers: Record<string, string> = {
-      'content-type': 'application/json',
-      'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36',
-    };
-    if (this.bearerToken) headers.Authorization = `Bearer ${this.bearerToken}`;
-    const response = await fetch(`${this.baseUrl}${path}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : undefined,
-    });
-    const text = await response.text();
-    const parsed = text ? JSON.parse(text) : {};
-    if (!response.ok) throw new Error(`room13_http_${response.status}:${JSON.stringify(parsed).slice(0, 1000)}`);
-    return parsed as T;
-  }
-}
-
-export function installGitHubIssuesWorkerRuntime(runtime: GitHubIssuesRoom13WorkerRuntime | null) {
-  currentRuntime = runtime;
-}

src/runtime.ts

@@ -1,42 +1,20 @@
-import { exec } from 'node:child_process';
+import { exec, execFile } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
-import { commentIssue, closeIssue, ensureIssue } from './github.js';
 import { createClient } from '@supabase/supabase-js';
-import { getCurrentGitHubIssuesWorkerRuntime } from './room13-worker.js';
-import {
-  buildDeliveryKey,
-  buildIssueKey,
-  routeIssueTriage,
-  routeLabelsToTeam,
-  TriageEnqueueSchema,
-  type TriageEnqueueInput,
-} from './triage.js';
-import { ISSUE_QUEUE_STATE } from './queue-state.js';
+import { commentIssueAsGitHubApp, getGitHubAppRoutingStatus, routeGitHubWebhook } from './github-app-routing.js';
 
 const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 export type GitHubAgentAction =
   | { action: 'agent.help' }
   | { action: 'sin.github.health' }
-  | { action: 'sin.github.worker.register' }
-  | { action: 'sin.github.worker.status' }
-  | { action: 'sin.github.worker.claim_next' }
-  | { action: 'sin.github.worker.checkpoint'; step: string; checkpoint?: Record<string, unknown> }
-  | { action: 'sin.github.worker.complete'; result?: Record<string, unknown> }
-  | { action: 'sin.github.issue.ensure'; repo: string; title: string; body: string; labels?: string[] }
-  | { action: 'sin.github.issue.comment'; repo: string; issueNumber: number; body: string }
-  | { action: 'sin.github.issue.close'; repo: string; issueNumber: number; comment?: string }
-  | {
-      action: 'sin.github.issue.triage.enqueue';
-      repo: string;
-      issueNumber: number;
-      title: string;
-      body?: string;
-      labels?: string[];
-      assignedTeam?: string;
-      deliveryId?: string;
-      eventAction?: string;
-    }
+  | { action: 'sin.github.app.routing.status' }
+  | { action: 'sin.github.webhook.route'; payload?: unknown; rawBody?: string; routePath?: string; signature256?: string; eventName?: string; deliveryId?: string }
+  | { action: 'sin.github.issue.comment.as_app'; repo: string; issueNumber: number; body: string; agentSlug?: string; appId?: number; installationId: number }
   | { action: 'sin.github.project.orchestrate'; prompt: string; contextDir?: string }
   | { action: 'sin.github.issue.manage'; prompt: string; issueNumber?: number }
   | { action: 'sin.github.wiki.sync'; prompt: string; contextDir?: string }
@@ -44,6 +22,7 @@ export type GitHubAgentAction =
   | { action: 'sin.github.gist.publish'; prompt: string; isPublic?: boolean }
   | { action: 'sin.github.security.audit'; prompt: string; contextDir?: string }
   | { action: 'sin.github.pr.review'; prNumber: number; contextDir?: string }
+  | { action: 'sin.github.issue.pool.enqueue'; repoName: string; issueNumber: number; title: string; body?: string; labels?: string[]; issueUrl?: string; assignedTeam?: string; assignedAgent?: string; status?: string; state?: string; routingStrategy?: string; fanoutPlan?: unknown[] }
   | { action: 'sin.github.ledger.log'; agentName: string; activityTitle: string; details: string };
 
 export async function executeGitHubAgentAction(action: GitHubAgentAction): Promise<unknown> {
@@ -55,15 +34,9 @@ export async function executeGitHubAgentAction(action: GitHubAgentAction): Promi
         mandate: 'CEO Elite GitHub Operations. Orchestrates Projects, Issues, Wikis, Discussions, Gists, Security, PR Reviews, and public Showcase Ledgers.',
         actions: [
           'sin.github.health',
-          'sin.github.worker.register',
-          'sin.github.worker.status',
-          'sin.github.worker.claim_next',
-          'sin.github.worker.checkpoint',
-          'sin.github.worker.complete',
-          'sin.github.issue.ensure',
-          'sin.github.issue.comment',
-          'sin.github.issue.close',
-          'sin.github.issue.triage.enqueue',
+          'sin.github.app.routing.status',
+          'sin.github.webhook.route',
+          'sin.github.issue.comment.as_app',
           'sin.github.project.orchestrate',
           'sin.github.issue.manage',
           'sin.github.wiki.sync',
@@ -71,6 +44,7 @@ export async function executeGitHubAgentAction(action: GitHubAgentAction): Promi
           'sin.github.gist.publish',
           'sin.github.security.audit',
           'sin.github.pr.review',
+          'sin.github.issue.pool.enqueue',
           'sin.github.ledger.log'
         ],
       };
@@ -83,41 +57,18 @@ export async function executeGitHubAgentAction(action: GitHubAgentAction): Promi
         fallbackModel: 'opencode/minimax-m2.5-free',
         team: 'Team - Coding',
         status: 'Elite 2026 GitHub Operations Architect Online',
-        capabilities: ['projects', 'wikis', 'discussions', 'gists', 'security', 'prs', 'issues', 'ledger'],
-        room13Worker: getCurrentGitHubIssuesWorkerRuntime()?.snapshot() || null,
+        capabilities: ['projects', 'wikis', 'discussions', 'gists', 'security', 'prs', 'issues', 'ledger', 'github-app-routing'],
+        githubAppRouting: await getGitHubAppRoutingStatus(),
       };
 
-    case 'sin.github.worker.register':
-      return { ok: true, worker: await getCurrentGitHubIssuesWorkerRuntime()?.start() };
+    case 'sin.github.app.routing.status':
+      return await getGitHubAppRoutingStatus();
 
-    case 'sin.github.worker.status':
-      return { ok: true, worker: getCurrentGitHubIssuesWorkerRuntime()?.snapshot() || null };
+    case 'sin.github.webhook.route':
+      return await routeGitHubWebhook(action);
 
-    case 'sin.github.worker.claim_next':
-      return { ok: true, task: await getCurrentGitHubIssuesWorkerRuntime()?.claimNextTask() };
-
-    case 'sin.github.worker.checkpoint':
-      return { ok: true, checkpoint: await getCurrentGitHubIssuesWorkerRuntime()?.checkpoint(action.step, action.checkpoint || {}) };
-
-    case 'sin.github.worker.complete':
-      return { ok: true, completion: await getCurrentGitHubIssuesWorkerRuntime()?.completeTask(action.result || {}) };
-
-    case 'sin.github.issue.ensure':
-      return await ensureIssue({
-        repo: action.repo,
-        title: action.title,
-        body: action.body,
-        labels: action.labels,
-      });
-
-    case 'sin.github.issue.comment':
-      return await commentIssue(action.repo, action.issueNumber, action.body);
-
-    case 'sin.github.issue.close':
-      return await closeIssue(action.repo, action.issueNumber, action.comment);
-
-    case 'sin.github.issue.triage.enqueue':
-      return await enqueueIssueTriage(action);
+    case 'sin.github.issue.comment.as_app':
+      return await commentIssueAsGitHubApp(action);
 
     case 'sin.github.project.orchestrate':
       return await executeOpenCode(
@@ -158,21 +109,20 @@ export async function executeGitHubAgentAction(action: GitHubAgentAction): Promi
         action.contextDir
       );
 
+    case 'sin.github.issue.pool.enqueue':
+      return await enqueueIssuePoolItem(action);
+
     case 'sin.github.ledger.log':
-      return await executeOpenCode(
-        `Create a new public GitHub Issue or Discussion in the repository 'Delqhi/OpenSolver-Ledger' titled "[${action.agentName}] ${action.activityTitle}". The body must contain the following details formatted in premium markdown to showcase our fleet's capabilities: \n\n${action.details}`
-      );
+      return await publishLedgerLog(action.agentName, action.activityTitle, action.details);
   }
 }
 
 async function executeOpenCode(prompt: string, dir?: string) {
   await execAsync('python3 scripts/hf_pull_script.py').catch(() => console.warn('Warning: hf_pull_script failed. Proceeding with cached credentials.'));
-
-  const cmd = `opencode run "${prompt.replace(/"/g, '\\"')}" --model openai/gpt-5.4 --fallback opencode/minimax-m2.5-free`;
   const options = dir ? { cwd: dir } : {};
 
   try {
-    const { stdout, stderr } = await execAsync(cmd, options);
+    const { stdout, stderr } = await execFileAsync('opencode', ['run', prompt, '--model', 'openai/gpt-5.4'], options);
     return {
       ok: true,
       expertAnalysis: stdout,
@@ -183,129 +133,96 @@ async function executeOpenCode(prompt: string, dir?: string) {
   }
 }
 
-async function enqueueIssueTriage(action: Extract<GitHubAgentAction, { action: 'sin.github.issue.triage.enqueue' }>) {
-  const input = TriageEnqueueSchema.parse(action) as TriageEnqueueInput;
-  const supabaseUrl = process.env.SUPABASE_URL || process.env.SIN_SUPABASE_URL;
-  const serviceRole = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SIN_SUPABASE_SERVICE_ROLE_KEY;
-  if (!supabaseUrl || !serviceRole) {
-    throw new Error('missing_supabase_credentials');
-  }
+async function publishLedgerLog(agentName: string, activityTitle: string, details: string) {
+  const title = `[${agentName}] ${activityTitle}`;
+  const body = [
+    `# ${activityTitle}`,
+    '',
+    `- Agent: ${agentName}`,
+    `- Published: ${new Date().toISOString()}`,
+    '',
+    '## Details',
+    details,
+  ].join('\n');
+  const tempDir = await mkdtemp(join(tmpdir(), 'sin-github-ledger-'));
+  const bodyPath = join(tempDir, 'ledger-body.md');
 
-  const supabase = createClient(supabaseUrl, serviceRole, { auth: { persistSession: false } });
-  const deliveryId = buildDeliveryKey(input);
-  const issueKey = buildIssueKey(input.repo, input.issueNumber);
-  const labels = input.labels || [];
-  const route = routeIssueTriage(labels, input.title, input.body || '');
-  const assignedTeam = input.assignedTeam || route.assignedTeam;
-
-  const { data: byDelivery, error: deliveryError } = await supabase
-    .from('sin_issues_pool')
-    .select('id, issue_number, repo_name, title, status, metadata, delivery_id')
-    .eq('delivery_id', deliveryId)
-    .maybeSingle();
-  if (deliveryError) throw deliveryError;
-
-  if (byDelivery) {
+  try {
+    await writeFile(bodyPath, body, 'utf8');
+    const { stdout, stderr } = await execFileAsync('gh', [
+      'issue',
+      'create',
+      '-R',
+      'Delqhi/OpenSIN-Ledger',
+      '--title',
+      title,
+      '--body-file',
+      bodyPath,
+    ]);
     return {
       ok: true,
-      created: false,
-      deduplicatedBy: 'delivery_id',
-      queueId: byDelivery.id,
-      issueKey,
-      status: byDelivery.status,
-      deliveryId,
+      repo: 'Delqhi/OpenSIN-Ledger',
+      title,
+      url: stdout.trim(),
+      warnings: stderr || undefined,
     };
+  } catch (error: any) {
+    throw new Error(`GitHub Ledger Publish Failed: ${error.message}`);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true }).catch(() => undefined);
   }
+}
 
-  const { data: existing, error: selectError } = await supabase
-    .from('sin_issues_pool')
-    .select('id, issue_number, repo_name, title, status, metadata, delivery_id')
-    .eq('repo_name', input.repo)
-    .eq('issue_number', input.issueNumber)
-    .maybeSingle();
-  if (selectError) throw selectError;
-
-  if (existing) {
-    const mergedMetadata = {
-      ...(existing.metadata || {}),
-      last_delivery_id: deliveryId,
-      issue_key: issueKey,
-      event_action: input.eventAction || 'opened',
-      labels,
-      ingress: 'github-issues-runtime',
-      route,
-    };
-
-    const { error: updateError } = await supabase
-      .from('sin_issues_pool')
-      .update({
-        metadata: mergedMetadata,
-        delivery_id: deliveryId,
-        updated_at: new Date().toISOString(),
-      })
-      .eq('id', existing.id);
-    if (updateError) throw updateError;
+async function enqueueIssuePoolItem(action: Extract<GitHubAgentAction, { action: 'sin.github.issue.pool.enqueue' }>) {
+  const supabaseUrl = (process.env.SUPABASE_URL || process.env.SIN_SUPABASE_URL || '').trim();
+  const serviceRoleKey = (process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SIN_SUPABASE_SERVICE_ROLE_KEY || '').trim();
 
-    return {
-      ok: true,
-      created: false,
-      deduplicatedBy: 'issue_key',
-      queueId: existing.id,
-      issueKey,
-      status: existing.status,
-      deliveryId,
-    };
+  if (!supabaseUrl || !serviceRoleKey) {
+    throw new Error('sin_supabase_config_missing: set SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY or SIN_SUPABASE_URL/SIN_SUPABASE_SERVICE_ROLE_KEY before enqueueing issue-pool items');
   }
 
+  const supabase = createClient(supabaseUrl, serviceRoleKey, {
+    auth: { persistSession: false, autoRefreshToken: false },
+  });
+
   const payload = {
-    issue_number: input.issueNumber,
-    repo_name: input.repo,
-    title: input.title,
-    body: input.body || '',
-    state: 'open',
-    assigned_team: assignedTeam,
-    assigned_agent: null,
-    status: 'pending',
-    queue_state: ISSUE_QUEUE_STATE.queued,
-    delivery_id: deliveryId,
-    issue_key: issueKey,
-    event_action: input.eventAction || 'opened',
-    metadata: {
-      delivery_id: deliveryId,
-      issue_key: issueKey,
-      event_action: input.eventAction || 'opened',
-      labels,
-      ingress: 'github-issues-runtime',
-      route,
-    },
+    issue_number: action.issueNumber,
+    repo_name: action.repoName,
+    title: action.title,
+    body: action.body || null,
+    labels: action.labels || [],
+    issue_url: action.issueUrl || null,
+    state: action.state || 'open',
+    assigned_team: action.assignedTeam || 'team-coding',
+    assigned_agent: action.assignedAgent || null,
+    status: action.status || 'open',
+    routing_strategy: action.routingStrategy || 'single-dispatch',
+    fanout_plan: action.fanoutPlan || [],
+    updated_at: new Date().toISOString(),
   };
 
-  const { data: inserted, error: insertError } = await supabase
-    .from('sin_issues_pool')
-    .insert(payload)
-    .select('id, status')
-    .single();
-  if (insertError) throw insertError;
-
-  await commentIssue(
-    input.repo,
-    input.issueNumber,
-    [
-      'AZA-SIN-Coder-•-GitHub-Issues triage complete.',
-      `Delivery: ${deliveryId}`,
-      `Assigned team: @${assignedTeam}`,
-      `Assigned agent hint: @${route.assignedAgentHint}`,
-      `Capability hint: ${route.capabilityHint}`,
-      `Queue status: ${ISSUE_QUEUE_STATE.queued}`,
-    ].join('\n'),
-  );
+  let { data, error } = await supabase.from('sin_issues_pool').insert(payload).select('*').single();
+  if (error && /column/i.test(error.message)) {
+    const fallbackPayload = {
+      issue_number: action.issueNumber,
+      repo_name: action.repoName,
+      title: action.title,
+      body: action.body || null,
+      state: action.state || 'open',
+      assigned_team: action.assignedTeam || 'team-coding',
+      assigned_agent: action.assignedAgent || null,
+      status: action.status || 'pending',
+      updated_at: new Date().toISOString(),
+    };
+    ({ data, error } = await supabase.from('sin_issues_pool').insert(fallbackPayload).select('*').single());
+  }
+  if (error) {
+    throw new Error(`sin_issue_pool_enqueue_failed: ${error.message}`);
+  }
 
   return {
     ok: true,
-    created: true,
-    queueId: inserted.id,
-    issueKey,
-    status: inserted.status,
-    deliveryId,
+    table: 'sin_issues_pool',
+    item: data,
   };
 }

src/self-healing.ts

@@ -1,32 +0,0 @@
-import { execFileSync } from 'node:child_process';
-
-/**
- * 🚨 GLOBAL FLEET SELF-HEALING PROTOCOL (PRIORITY 0000) 🚨
- * NO-SILO MANDATE: This module catches critical errors, dumps extensive logs,
- * and blasts them to the fleet self-healing webhook.
- * Hermes and AZA-SIN-Coder-•-GitHub-Issues will automatically take over from there.
- */
-
-export function triggerFleetSelfHealing(error: Error, extensiveContext: Record<string, any>) {
-  console.error('\n🚨 CRITICAL FAILURE DETECTED. INITIATING NO-SILO SELF-HEALING PROTOCOL 🚨');
-  
-  const payload = {
-    agentId: 'AZA-SIN-Coder-•-GitHub-Issues',
-    timestamp: new Date().toISOString(),
-    errorLogs: `Error: ${error.message}\nStack: ${error.stack}\nContext: ${JSON.stringify(extensiveContext, null, 2)}`,
-    team: 'team-coding'
-  };
-
-  try {
-    const webhookUrl = process.env.FLEET_SELF_HEALING_WEBHOOK || 'http://92.5.60.87:5678/webhook/self-healing';
-    
-    // Blast to the N8N foundation webhook
-    const curlCmd = `curl -X POST "${webhookUrl}" -H "Content-Type: application/json" -d '${JSON.stringify(payload).replace(/'/g, "'\\''")}'`;
-    
-    execFileSync('bash', ['-c', curlCmd], { encoding: 'utf8' });
-    console.log('✅ Extensive logs successfully transmitted to Fleet Self-Healing pipeline.');
-    console.log('👷 The Elite Coder Fleet has been notified and will resolve this architecture flaw autonomously.');
-  } catch (transmitError: any) {
-    console.error('❌ FATAL: Could not transmit logs to Fleet Self-Healing pipeline.', transmitError.message);
-  }
-}

src/triage.ts

@@ -1,100 +0,0 @@
-import { z } from 'zod';
-
-export { ISSUE_QUEUE_STATE } from './queue-state.js';
-export type { IssueQueueState as IssueQueueStatus } from './queue-state.js';
-
-export const TriageEnqueueSchema = z.object({
-  action: z.literal('sin.github.issue.triage.enqueue'),
-  repo: z.string().min(3),
-  issueNumber: z.number().int().positive(),
-  title: z.string().min(1),
-  body: z.string().optional(),
-  labels: z.array(z.string()).optional(),
-  assignedTeam: z.string().optional(),
-  deliveryId: z.string().optional(),
-  eventAction: z.string().optional(),
-});
-
-export type TriageEnqueueInput = z.infer<typeof TriageEnqueueSchema>;
-
-export type TriageRoute = {
-  assignedTeam: string;
-  assignedAgentHint: string;
-  capabilityHint: string;
-  rationale: string;
-};
-
-export function buildIssueKey(repo: string, issueNumber: number) {
-  return `${repo}#${issueNumber}`;
-}
-
-export function buildDeliveryKey(input: Pick<TriageEnqueueInput, 'repo' | 'issueNumber' | 'deliveryId' | 'eventAction'>) {
-  const eventAction = (input.eventAction || 'opened').trim() || 'opened';
-  const base = `${input.repo}#${input.issueNumber}:${eventAction}`;
-  return (input.deliveryId || '').trim() || `manual:${base}`;
-}
-
-export function routeIssueTriage(labels: string[], title = '', body = ''): TriageRoute {
-  const normalized = labels.map((label) => label.toLowerCase());
-  const haystack = `${title} ${body}`.toLowerCase();
-
-  if (normalized.some((label) => label.includes('frontend') || label.includes('ui')) || hasAny(haystack, ['react', 'tsx', 'css', 'layout', 'component'])) {
-    return {
-      assignedTeam: 'team-coding',
-      assignedAgentHint: 'A2A-SIN-Coder-Frontend',
-      capabilityHint: 'command:render-ui',
-      rationale: 'frontend/ui-signal',
-    };
-  }
-
-  if (normalized.some((label) => label.includes('database') || label.includes('sql') || label.includes('supabase')) || hasAny(haystack, ['schema', 'migration', 'postgres', 'rls', 'supabase'])) {
-    return {
-      assignedTeam: 'team-coding',
-      assignedAgentHint: 'A2A-SIN-Coder-Code-Database',
-      capabilityHint: 'command:data-model',
-      rationale: 'database-signal',
-    };
-  }
-
-  if (normalized.some((label) => label.includes('integration') || label.includes('webhook') || label.includes('api')) || hasAny(haystack, ['webhook', 'api', 'integration', 'queue', 'dispatch'])) {
-    return {
-      assignedTeam: 'team-coding',
-      assignedAgentHint: 'A2A-SIN-Coder-Code-Integration',
-      capabilityHint: 'command:integration',
-      rationale: 'integration-signal',
-    };
-  }
-
-  if (normalized.some((label) => label.includes('ai') || label.includes('llm') || label.includes('mcp')) || hasAny(haystack, ['prompt', 'llm', 'agent', 'mcp', 'rag'])) {
-    return {
-      assignedTeam: 'team-coding',
-      assignedAgentHint: 'A2A-SIN-Coder-Code-AI',
-      capabilityHint: 'command:ai-runtime',
-      rationale: 'ai-signal',
-    };
-  }
-
-  if (normalized.some((label) => label.includes('backend') || label.includes('infra') || label.includes('ops')) || hasAny(haystack, ['backend', 'worker', 'lease', 'heartbeat', 'runtime'])) {
-    return {
-      assignedTeam: 'team-coding',
-      assignedAgentHint: 'A2A-SIN-Coder-Backend',
-      capabilityHint: 'command:backend-runtime',
-      rationale: 'backend-signal',
-    };
-  }
-
-  return {
-    assignedTeam: 'team-coding',
-    assignedAgentHint: 'A2A-SIN-Coder-Backend',
-    capabilityHint: 'command:implement',
-    rationale: 'default-coder-route',
-  };
-}
-
-export function routeLabelsToTeam(labels: string[], title = '', body = '') {
-  return routeIssueTriage(labels, title, body).assignedTeam;
-}
-
-function hasAny(haystack: string, needles: string[]) {
-  return needles.some((needle) => haystack.includes(needle));
-}

test/github_workflow.test.mjs

@@ -0,0 +1,156 @@
+import assert from 'node:assert/strict';
+import { createHmac, generateKeyPairSync } from 'node:crypto';
+import { createServer } from 'node:http';
+import test from 'node:test';
+
+const DIST_ROOT = new URL('../dist/src/', import.meta.url);
+
+async function importFresh(relativePath) {
+  return import(new URL(`${relativePath}?t=${Date.now()}-${Math.random()}`, DIST_ROOT).href);
+}
+
+function setEnv(updates) {
+  const previous = new Map();
+  for (const [key, value] of Object.entries(updates)) {
+    previous.set(key, process.env[key]);
+    if (value === undefined || value === null) delete process.env[key];
+    else process.env[key] = value;
+  }
+  return () => {
+    for (const [key, value] of previous.entries()) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  };
+}
+
+test('GitHub Agent help exposes routing actions', async () => {
+  const { executeGitHubAgentAction } = await importFresh('./runtime.js');
+
+  const help = await executeGitHubAgentAction({ action: 'agent.help' });
+  assert.equal(help.ok, true);
+  assert.ok(help.actions.includes('sin.github.app.routing.status'));
+  assert.ok(help.actions.includes('sin.github.webhook.route'));
+  assert.ok(help.actions.includes('sin.github.issue.comment.as_app'));
+});
+
+test('routeGitHubWebhook prefers installation.app_id over shared central path', async () => {
+  const restoreEnv = setEnv({
+    SIN_GITHUB_APP_ROUTING_JSON: JSON.stringify({
+      mode: 'central-endpoint-routing',
+      defaultWebhookPath: '/api/webhooks/github-apps',
+      apps: [
+        {
+          appIdEnv: 'SIN_HERMES_GITHUB_APP_ID',
+          appSlug: 'sin-hermes',
+          preferredAgentSlug: 'sin-hermesbote',
+          botName: 'SIN-Hermes[bot]',
+          webhookPath: '/api/webhooks/github-apps',
+          webhookSecretEnv: 'SIN_HERMES_GITHUB_APP_WEBHOOK_SECRET',
+        },
+        {
+          appIdEnv: 'SIN_BUGBOUNTY_GITHUB_APP_ID',
+          appSlug: 'sin-bugbounty',
+          preferredAgentSlug: 'sin-bugbounty',
+          botName: 'SIN-BugBounty[bot]',
+          webhookPath: '/api/webhooks/github-apps',
+          webhookSecretEnv: 'SIN_BUGBOUNTY_GITHUB_APP_WEBHOOK_SECRET',
+        },
+      ],
+    }),
+    SIN_HERMES_GITHUB_APP_ID: '123456',
+    SIN_HERMES_GITHUB_APP_WEBHOOK_SECRET: 'secret-1',
+    SIN_BUGBOUNTY_GITHUB_APP_ID: '345678',
+    SIN_BUGBOUNTY_GITHUB_APP_WEBHOOK_SECRET: 'secret-3',
+  });
+
+  try {
+    const { routeGitHubWebhook } = await importFresh('./github-app-routing.js');
+    const rawBody = JSON.stringify({
+      action: 'opened',
+      installation: { id: 987654321, app_id: 345678 },
+      repository: { full_name: 'OpenSIN-AI/OpenSIN-backend' },
+    });
+    const signature256 = `sha256=${createHmac('sha256', 'secret-3').update(rawBody).digest('hex')}`;
+    const result = await routeGitHubWebhook({
+      rawBody,
+      routePath: '/api/webhooks/github-apps',
+      signature256,
+      eventName: 'pull_request',
+      deliveryId: 'delivery-central-test',
+    });
+    assert.equal(result.ok, true);
+    assert.equal(result.route.agentSlug, 'sin-bugbounty');
+    assert.equal(result.route.botName, 'SIN-BugBounty[bot]');
+  } finally {
+    restoreEnv();
+  }
+});
+
+test('commentIssueAsGitHubApp exchanges installation token and posts comment', async () => {
+  const { privateKey } = generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
+    publicKeyEncoding: { type: 'pkcs1', format: 'pem' },
+  });
+
+  let commentRequestBody = '';
+  const server = createServer((req, res) => {
+    if (req.method === 'POST' && req.url === '/app/installations/987654321/access_tokens') {
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify({ token: 'installation-token-1', expires_at: '2030-01-01T00:00:00Z' }));
+      return;
+    }
+    if (req.method === 'POST' && req.url === '/repos/OpenSIN-AI/OpenSIN-backend/issues/42/comments') {
+      const chunks = [];
+      req.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+      req.on('end', () => {
+        commentRequestBody = Buffer.concat(chunks).toString('utf8');
+        res.writeHead(200, { 'content-type': 'application/json' });
+        res.end(JSON.stringify({ id: 9001, html_url: 'https://github.com/OpenSIN-AI/OpenSIN-backend/issues/42#issuecomment-9001' }));
+      });
+      return;
+    }
+    res.writeHead(404, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ error: 'not_found' }));
+  });
+
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const address = server.address();
+  const port = typeof address === 'object' && address ? address.port : 0;
+  const restoreEnv = setEnv({
+    SIN_GITHUB_API_BASE_URL: `http://127.0.0.1:${port}`,
+    SIN_GITHUB_APP_ROUTING_JSON: JSON.stringify({
+      defaultMode: 'hybrid',
+      defaultWebhookPath: '/github/webhook',
+      apps: [
+        {
+          agentSlug: 'sin-hermesbote',
+          appSlug: 'sin-hermes',
+          botName: 'SIN-Hermes[bot]',
+          appId: 123456,
+          privateKeyPem: privateKey,
+          webhookSecret: 'secret-1',
+        },
+      ],
+    }),
+  });
+
+  try {
+    const { commentIssueAsGitHubApp } = await importFresh('./github-app-routing.js');
+    const result = await commentIssueAsGitHubApp({
+      repo: 'OpenSIN-AI/OpenSIN-backend',
+      issueNumber: 42,
+      body: 'Hello from SIN-Hermes[bot]',
+      agentSlug: 'sin-hermesbote',
+      installationId: 987654321,
+    });
+    assert.equal(result.ok, true);
+    assert.equal(result.agentSlug, 'sin-hermesbote');
+    assert.equal(result.commentId, 9001);
+    assert.match(commentRequestBody, /Hello from SIN-Hermes\[bot\]/);
+  } finally {
+    restoreEnv();
+    await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+  }
+});