Migrate GitHub webhook normalization into github tool (#758)

* Add event-triggered routines and workflow skill templates

* Add generic host-verified webhook ingress for tools

* Migrate GitHub webhook normalization into github tool

* Bump github tool registry version

* Stabilize trace E2E test rig and approval behavior

* Add reusable gateway workflow harness with mock LLM server (#762)

* Add reusable gateway workflow test harness with mock LLM server

* Fix clippy issues in workflow harness

* Stabilize trace E2E test rig and approval behavior

* Address PR review feedback on gateway workflow harness

- Extract shared TestChannelHandle into test_channel.rs with name override
  support, eliminating ~55 lines of duplication between test_rig.rs and
  gateway_workflow_harness.rs
- Remove redundant RoutineEngine creation that was immediately overwritten
  by Agent::run()
- Replace flaky sleep(500ms) with polling loop for routine run count check
- Use components.context_manager instead of creating a fresh ContextManager
  for job tools, ensuring agent and tools share the same instance

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Fix import ordering in gateway_workflow_harness

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

* Address PR #758 review feedback

- Fix header_value to use fully case-insensitive lookup (iterate with
  to_ascii_lowercase) instead of checking only exact/lower/upper variants
- Change comment_id from u32 to u64 to handle GitHub's billion-range IDs
- Remove handle_webhook from LLM-facing JSON schema to prevent direct
  invocation bypassing HMAC verification
- Rename enrichment keys from repository/sender to repository_name/
  sender_login to preserve original JSON objects in webhook payloads
- Remove put_string_normalized helper (no longer needed)
- Replace no-op tests (test_validate_event_in_create_pr_review,
  test_validate_merge_method) with test_header_value_case_insensitive
- Add README docs for 6 undocumented actions (list_issue_comments,
  create_issue_comment, list_pull_request_comments,
  reply_pull_request_comment, get_pull_request_reviews,
  get_combined_status)
- Add comment explaining max_tool_calls <= 8 bound in e2e test
- Fix gateway workflow harness: add webhook_capability with secret auth
  to MockGithubWebhookTool, matching staging's hardened webhook security
- Fix merge artifacts: remove duplicate test function, orphaned code
  fragment in e2e_routine_heartbeat

[skip-regression-check]

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Fix formatting in gateway workflow harness

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Address Copilot review: filter keys, pr_number fallback, feature gate, version alignment

- Update SKILL.md and workflow-routines.md templates to use `repository_name`
  and `sender_login` (matching enriched payload field names)
- Mark webhook HMAC secret as required in SKILL.md prerequisites
- Fall back to `/issue/number` for `pr_number` on issue_comment PR webhooks
- Gate `gateway_workflow_harness` module behind `#[cfg(feature = "libsql")]`
- Align tool version to 0.2.1 in Cargo.toml and capabilities.json

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

skills/ironclaw-workflow-orchestrator/SKILL.md

@@ -28,7 +28,9 @@ Collect these values before creating routines:
 Before installing routines, verify:
 - Routines system enabled.
 - GitHub tool authenticated (for issue/PR/comment/status operations).
-- Events are emitted via `event_emit` tool calls (a future HTTP webhook ingestion endpoint is planned but not yet available).
+- GitHub webhook delivery configured to `POST /webhook/tools/github`.
+- Webhook HMAC secret configured in the secrets store as `github_webhook_secret` (required for GitHub webhook delivery).
+- Events can also be emitted via `event_emit` tool calls for testing or when webhook ingestion is not yet configured.
 
 ## Install Procedure
 1. Open [`workflow-routines.md`](references/workflow-routines.md).
@@ -51,8 +53,8 @@ Install these routines:
 
 ## Event Filters
 Prefer top-level filters for stability:
-- `repository` (string)
-- `sender` (string)
+- `repository_name` (string, e.g. `owner/repo`)
+- `sender_login` (string)
 - `issue_number` / `pr_number`
 - `ci_status`, `ci_conclusion`
 - `review_state`, `comment_author`

skills/ironclaw-workflow-orchestrator/references/workflow-routines.md

@@ -12,7 +12,7 @@ Replace `{{...}}` placeholders before use.
   "event_source": "github",
   "event_type": "issue.opened",
   "event_filters": {
-    "repository": "{{repository}}"
+    "repository_name": "{{repository}}"
   },
   "action_type": "full_job",
   "prompt": "For issue #{{issue_number}} in {{repository}}, produce a concrete implementation plan with milestones, edge cases, and tests. Post/update an issue comment with the plan.",
@@ -32,7 +32,7 @@ Trigger per-maintainer by creating one routine per handle, or maintain a shared
   "event_source": "github",
   "event_type": "pr.comment.created",
   "event_filters": {
-    "repository": "{{repository}}",
+    "repository_name": "{{repository}}",
     "comment_author": "{{maintainer}}"
   },
   "action_type": "full_job",
@@ -51,7 +51,7 @@ Trigger per-maintainer by creating one routine per handle, or maintain a shared
   "event_source": "github",
   "event_type": "pr.synchronize",
   "event_filters": {
-    "repository": "{{repository}}"
+    "repository_name": "{{repository}}"
   },
   "action_type": "full_job",
   "prompt": "For PR #{{pr_number}}, collect open review comments and unresolved threads, apply fixes, push branch updates, and summarize remaining blockers. If conflict with {{main_branch}}, rebase/merge from origin/{{main_branch}} and resolve safely.",
@@ -69,7 +69,7 @@ Trigger per-maintainer by creating one routine per handle, or maintain a shared
   "event_source": "github",
   "event_type": "ci.check_run.completed",
   "event_filters": {
-    "repository": "{{repository}}",
+    "repository_name": "{{repository}}",
     "ci_conclusion": "failure"
   },
   "action_type": "full_job",
@@ -102,7 +102,7 @@ Trigger per-maintainer by creating one routine per handle, or maintain a shared
   "event_source": "github",
   "event_type": "pr.closed",
   "event_filters": {
-    "repository": "{{repository}}",
+    "repository_name": "{{repository}}",
     "pr_merged": "true"
   },
   "action_type": "full_job",
@@ -118,9 +118,9 @@ Trigger per-maintainer by creating one routine per handle, or maintain a shared
   "source": "github",
   "event_type": "issue.opened",
   "payload": {
-    "repository": "{{repository}}",
+    "repository_name": "{{repository}}",
     "issue_number": 99999,
-    "sender": "test-bot"
+    "sender_login": "test-bot"
   }
 }
 ```