GitHub delivery watchdog

This is a deterministic scheduled host command. It creates no agent or conversation and needs no agent profile. Configure a repository-scoped fine-grained PAT with Contents and Issues read/write plus Pull requests, Actions, Commit statuses, and Metadata read. Contents write permits merge; Issues write retains the review label when the branch is updated. Never put the token value in the automation definition.

Package scripts/worker.py as worker.py and the shared scripts/github_client.py as github_client.py. The catalog bundle declares these exact files. Its config.json supplies repos, branch_prefix, and the saved secret name. The shared GitHub client resolves only that named secret. Automation owns scheduling and cancellation.

Set branch_prefix (default openhands/issue), base_branch (defaults to the repository's default branch), and required_workflow_ids when particular Actions workflows must run. The watchdog requires software-factory/tests and software-factory/review success statuses on the exact head, all other statuses and Actions passing, a current base, a non-draft PR, and GitHub reporting it mergeable. Missing, pending, failed, or inaccessible evidence does not permit merge. A changed head requires fresh review and tests. When an accepted branch is behind the base, the watchdog asks GitHub to update it and retains the review trigger label; it considers the new head only on a later run. The merge request includes the expected head SHA.

Actions are optional when required_workflow_ids is empty; the two acceptance statuses remain mandatory. Configure workflow IDs when GitHub Actions must also supply evidence. Branch protection remains GitHub's final merge gate.