Get retro agent working in fullsend-ai/fullsend

[ralphbean]

The story got closed out, but its failing. Get it working!

[github-actions]

fullsend triage is working on this — view logs

[fullsend-ai-triage]

Triage Summary

Title: Create missing GitHub App for prioritize agent in fullsend-ai org

Severity: High — the prioritize agent is completely non-functional since PR #603 merged.

Category: Bug (operational/configuration gap)

Problem

The issue title references the retro agent, but based on the detailed follow-up comments, the actual failure is in the prioritize agent. The prioritize workflow fails at the "Generate app token" step because the GitHub App was never created for the fullsend-ai organization. PR #603 added the agent scaffolding and workflow but the corresponding app provisioning step was not performed.

Root Cause

Missing GitHub App credentials: FULLSEND_PRIORITIZE_CLIENT_ID (variable) and FULLSEND_PRIORITIZE_APP_PRIVATE_KEY (secret) do not exist in the .fullsend repo.

Recommended Fix

Run the existing fullsend CLI installer with prioritize added to the agents list:

make go-build
./bin/fullsend admin install fullsend-ai \
  --agents fullsend,triage,coder,review,prioritize \
  --enroll-none

The installer is idempotent — it will reuse existing apps and only create the missing one.

Proposed Verification

# 1. Check credentials were created
gh variable list --repo fullsend-ai/.fullsend | grep PRIORITIZE
gh secret list --repo fullsend-ai/.fullsend | grep PRIORITIZE

# 2. Monitor the next prioritize workflow run
# Check https://github.com/fullsend-ai/.fullsend/actions/workflows/prioritize.yml

# 3. Regression prevention: consider a CI check that validates
#    all agent roles in config.yaml have provisioned credentials

Previous run

Thanks for filing this. The description mentions the retro agent is failing, but there isn't enough detail to act on yet. The retro agent has several components (feedback capture, correction storage, context assembly, post-script issue filing), and "failing" could mean many different things.

Could you share the specific failure you're seeing? For example:

• Is there an error message or stack trace from a failed agent run?
• Which part of the retro agent flow is breaking — is it the agent run itself, the post-script, feedback ingestion, or something else?
• Is there a link to a specific GitHub Actions run or log output that shows the failure?

This will help identify which component needs attention and whether this is related to existing open work like issue #672 (retro agent post-script cross-org authorization).

[ralphbean]

Root Cause Identified

The prioritize workflow is failing because the GitHub App for the prioritize agent was never created.

Evidence:

• Workflow failure: Error: The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string
• Failed at step: Generate app token using actions/create-github-app-token@v3
• Missing: FULLSEND_PRIORITIZE_CLIENT_ID (variable) and FULLSEND_PRIORITIZE_APP_PRIVATE_KEY (secret)

Why:
PR #603 added the prioritize agent role, workflow, and all the scaffolding, but the GitHub App was never created for the fullsend-ai organization. The workflow expects the app credentials to exist in the .fullsend repo's Actions variables/secrets.

Failed runs:

• https://github.com/fullsend-ai/.fullsend/actions/runs/25734425708
• https://github.com/fullsend-ai/.fullsend/actions/runs/25734423828
• https://github.com/fullsend-ai/.fullsend/actions/runs/25734422095
• https://github.com/fullsend-ai/.fullsend/actions/runs/25734419862

All failing since PR #603 merged.

[ralphbean]

Solution: Create the Missing GitHub App

The fullsend CLI installer can create the missing prioritize app while preserving existing apps.

Steps:

# Build the CLI
make go-build

# Run install with prioritize added to the agents list
./bin/fullsend admin install fullsend-ai \
  --agents fullsend,triage,coder,review,prioritize \
  --enroll-none

What this does:

1. ✅ Reuses existing apps (fullsend, triage, coder, review) by checking their stored credentials
2. ✅ Creates only the new fullsend-ai-prioritize GitHub App with required permissions:
   • Organization Projects: write (for updating the project board)
   • Issues: write (for posting reasoning comments)
3. ✅ Stores FULLSEND_PRIORITIZE_APP_PRIVATE_KEY secret in .fullsend repo
4. ✅ Stores FULLSEND_PRIORITIZE_CLIENT_ID variable in .fullsend repo
5. ✅ Updates .fullsend/config.yaml to track the new app slug
6. ✅ --enroll-none prevents re-processing already enrolled repos

The installer is idempotent and designed to handle partial installations.

App permissions (from internal/forge/github/types.go:107-118):

case "prioritize":
    base.Description = fmt.Sprintf("Fullsend prioritize agent for %s", org)
    base.Permissions = AppPermissions{
        OrganizationProjects: "write",  // Organization-level Projects V2
        Issues:               "write",  // For posting reasoning comments
    }
    base.Events = []string{}  // Scheduled, not event-driven

[ralphbean]

Verification

After creating the app, verify the fix:

1. Check that variables/secrets were created:

gh variable list --repo fullsend-ai/.fullsend | grep PRIORITIZE
gh secret list --repo fullsend-ai/.fullsend | grep PRIORITIZE

Expected output:

FULLSEND_PRIORITIZE_CLIENT_ID    ...
FULLSEND_PRIORITIZE_APP_PRIVATE_KEY    ...

2. Trigger a manual workflow run:

# The prioritize workflow runs on schedule, but can be tested via
# the dispatch workflow or by waiting for the next scheduled run

3. Monitor workflow runs:

• Check https://github.com/fullsend-ai/.fullsend/actions/workflows/prioritize.yml
• The next run should pass the "Generate app token" step

4. Check installed apps:
Visit https://github.com/organizations/fullsend-ai/settings/installations to confirm fullsend-ai-prioritize appears in the list.

[github-actions]

fullsend triage is working on this — view logs

[github-actions]

fullsend triage is working on this — view logs

[github-actions]

fullsend code is working on this — view logs

[ralphbean]

Update: Retro Agent Has the Same Issue

The retro agent is also failing with the same missing credentials error. However, the retro agent role wasn't defined in the installer code, so I've added it.

Branch created: fix/add-retro-agent-app-config

• Adds case "retro": to AgentAppConfig in internal/forge/github/types.go
• Defines permissions: Actions:read, Contents:read, PullRequests:read, Issues:write
• Includes test coverage
• Commit: 098a2d0

Updated solution to fix both prioritize and retro:

# Checkout the fix branch and build
git fetch origin fix/add-retro-agent-app-config
git checkout fix/add-retro-agent-app-config
make go-build

# Install both missing apps
./bin/fullsend admin install fullsend-ai \
  --agents fullsend,triage,coder,review,prioritize,retro \
  --enroll-none

This will create both fullsend-ai-prioritize and fullsend-ai-retro GitHub Apps with correct permissions and store their credentials in the .fullsend repo.

Alternative if you want to install from main:
Wait for the fix branch to be merged, then run with just prioritize in the agents list (retro will need the code changes merged first).