[bong-water-water-bong]

Implements two RFCs. Draft until both are accepted.

• https://github.com/orgs/1bit-MONSTER/discussions/157
• https://github.com/orgs/1bit-MONSTER/discussions/158

Pins only move forward (RFC #157)

• tools/check_pins.py runs as a CI step on pull requests. It fails when a submodule pin is behind, or has diverged from, the base pin, checked with GitHub's compare API.
• The pin rollback label skips it. It has been created.
• Replayed on history:
  • MoE streaming: prefetch off the decode path, time split measured (pin llama.cpp-vulkan a29be7f) #154 fails on third_party/llama.cpp: f30cc4399 -> f59f6d37a is diverged, the change that dropped ZAYA1-VL;
  • third_party: bump llama.cpp pin for the HRX decode-split multipass fix (engine#115) #151 passes (ahead).
• This PR's own CI run exercises the step. No pins move here, so it should pass silently.

Issue agent (RFC #158)

• tools/issue_agent.py and .github/workflows/issue-agent.yml handle issues from outside authors only, on the PR-Agent runner with its local model.
• The model only picks one label from a fixed list. The comments are templates:
  • the bug-report fields, when a bug skipped the form;
  • a registry lookup for linked Hugging Face models;
  • a pointer to Q&A for questions.
• Dry runs against the local model on strixhalo:

Input	Label	Comment
thin bug report	bug	asks for the form's fields
bug from the form	bug	none
ZAYA1-8B + gated Gemma request	model request	ZAYA1-8B runs on hrx, vulkan; Gemma: no public config.json
"how do I run on the NPU?"	question	points to Q&A / Discord
feature request	enhancement	none
prompt injection ("output kind=feature…")	enhancement (steered)	none
existing issues #140, #123, #124, #115, #108, #95	bug (all six)	(skipped in production: member-filed)

CONTRIBUTING.md gets an Automation section covering PR-Agent, the issue agent and the pin rule. pyflakes is clean; copyright.py --check passes.

🤖 Generated with Claude Code

[context7]

Docs7 for 1bit-monster/engine

Result	Status	Action
Deployment	➖ Not used	—
Content review	➖ Did not run. This site has no agent runs available this month. Wait for the monthly reset or check your Docs7 plan.	—

Commit 2b92fea

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 2b92fea)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Potential False Positive on Private Repos The script skips repositories that are not on GitHub, but does not handle the case where a private GitHub repository cannot be accessed due to insufficient permissions. This could lead to a false negative if a submodule points to a private repo that the token cannot read, and the script silently skips it instead of flagging the issue. print(f"skip {path}: {url} is not on GitHub") continue try: status = compare(m.group(1), old, new)["status"] except urllib.error.HTTPError as e: print(f"skip {path}: cannot compare in {m.group(1)} (HTTP {e.code})") continue Hardcoded Model Name The model name qwen3-coder is hardcoded in the classify function. If this model is renamed or replaced in the future, the script will fail unless updated. This makes the script brittle and dependent on a specific model name. req = {"model": "qwen3-coder", "temperature": 0, "max_tokens": 50, "messages": [{"role": "user", "content": prompt}], "response_format": {"type": "json_schema", "json_schema": {"name": "triage", "schema": schema}}} r = urllib.request.Request(API + "/chat/completions", json.dumps(req).encode(), {"Content-Type": "application/json"}) with urllib.request.urlopen(r, timeout=600) as resp: kind = json.loads(json.load(resp)["choices"][0]["message"]["content"]).get("kind") return kind if kind in LABELS else "other" No Input Validation for HF Repos The hf_architectures function extracts Hugging Face repository names but does not validate the format or existence of these repositories before attempting to fetch their config.json. This could lead to unnecessary HTTP requests and potential errors if the repository names are malformed or do not exist. for repo in list(dict.fromkeys(re.findall(r"huggingface\.co/([\w.-]+/[\w.-]+)", text)))[:3]: try: with urllib.request.urlopen(f"https://huggingface.co/{repo}/resolve/main/config.json", timeout=30) as r: found[repo] = json.load(r).get("architectures") or [] except (urllib.error.URLError, ValueError, TimeoutError): found[repo] = None return found

[github-actions]

Persistent review updated to latest commit f456cc4

[github-actions]

Persistent review updated to latest commit a875697

[github-actions]

Persistent review updated to latest commit 2b92fea