ci: atlas-sync — new External proxies auto-request their review

[ransomr]

When discovery creates a proxy for a new external upstream PR, it now posts @review on it immediately — marvin's comment fires the reviewer's external mode (word-boundary trigger; External label + upstream URL already in the freshly-written body), so the automated analysis is waiting on the proxy before a human ever opens it.

Lifecycle: proxy created (Review) → auto-@review → external review runs (Agent, 👀 on the comment) → findings posted on the proxy → back to Review with the ball visibly yours. Creation-time only — the heal path never re-requests; a manual @review remains the re-run path. Cost note: each newly-tracked external PR now spends one review run automatically.

🤖 Generated with Claude Code

[claude]

Review

Small, well-scoped change: discovery now posts the review-trigger comment on each freshly created External proxy so the automated external review is already running before a human opens it. I verified the full trigger chain and it is sound:

• The machine account is a real user on a PAT, so its comment fires issue_comment workflows (no GITHUB_TOKEN suppression) and passes claude-code-action’s human-actor check without needing allowed_bots.
• The fork stub’s gate (issue.pull_request == null + External label + trigger substring) and the shared workflow’s word-boundary grep both match the exact-body comment; the label and upstream URL are already in place because the comment posts after issue creation and ensure_on_board.
• The machine account has write access, so the ack/stage steps run — the lifecycle in the PR description (Review → Agent → findings → Review) holds.
• No unintended cross-triggers: claude.yml gates out the machine account’s actor, and claude-auto.yml’s review-fix keys on the summary marker, which this comment lacks.
• gh api -f (raw-field) does no @-file expansion (that is -F only), so the literal trigger text posts correctly.
• The freshly created proxy is inert for the same run’s state-sync pass (external + stage not Contributor), so no interference there.

Findings — all non-blocking (two inline, one here):

1. Unrecoverable failure window (inline): if the trigger-comment call fails transiently, the proxy is already created and boarded, so the next run’s dedup skips it and the heal path has nothing to fix — the automated review is silently never requested, even though the new issue-body text promises the human that findings will land on the issue. Isolate the call in its own try/except with a distinct action line.
2. Reuse (inline): the comment() helper already wraps this exact gh api call.
3. Doc drift (minor): the module docstring’s “Every write is idempotent” (line 21) is no longer strictly true — the trigger comment is at-most-once via create-path dedup, not idempotent — and the task-1 summaries (module docstring lines 7–10, atlas-sync.yml header) don’t mention the new auto-request step. Worth a one-line touch-up in each.

No correctness or security issues found.

[claude]

🔎 Review complete.