feat: per-family drift notifications + stage-3 verification agent

[monsagri]

RUBBER STAMP - only edits to autogen pipeline that's not used in our main branch/release

Extends the API-coverage autogen pipeline (stages 1/2 shipped in #445/#446/#453) with two main-side workflow additions. Both are workflow-YAML only — no provider/tool code changes — and follow the established pattern of living on main (for workflow_dispatch registration) while operating on the preview-v3 line.

1. Per-family drift notifications (drift-report.yml)

Replaces the single truncated drift blob with one summary message plus one message per drifting family, posted individually to a generic {title, body} Slack Workflow Builder trigger:

• Summary — drift counts (zero categories dropped) + scaffoldable families + a run link.
• Per new family — its paths + a link/CLI to dispatch the stage-2 scaffold workflow for that family.
• Per partial family with unclaimed operations — the lagging ops, flagged as needing a manual PR (stage 2 only scaffolds new resources).

No tool change: driftreport -format json already emits new_families / unclaimed_operations / status_counts and preserves exit-2-on-drift. Public-repo safety preserved — detail goes only to the private Slack channel (passed to curl, never echoed); the step summary stays yes/no.

2. Stage-3 verification agent (verify-scaffold.yml, new)

workflow_dispatch(pr_number) → verifies a stage-2 scaffolded draft PR against a real LaunchDarkly account before a human finishes it:

guard the PR (same-repo, scaffold/*, open) → check out the PR branch → fetch the LD token from SSM via AWS OIDC (same path as the acceptance matrix; api_host forced to prod) → build the provider to a pinned GOBIN with a terraform dev override → run claude-code-action to review the code and exercise the new resource with real terraform plan/apply, fixing functionality/tests until apply is clean. Applied example resources are retained (no destroy), namespaced tf-verify-pr<N> and pre-cleaned per run. Results post as a PR comment + a "ready for review" message on the same Slack trigger.

Security: prereq cleanup is a deterministic workflow step (the agent needs no curl with the live token); git tooling is scoped to the needed subcommands; runs are serialized per PR.

Validation

• actionlint clean on both workflows; YAML parses.
• Notification message-builder dry-run: summary + per-family messages render with working Slack mrkdwn links; verified live against the reshaped trigger.
• Stage-3 build → dev-override → load → schema-validate → configure chain verified locally (stops at the auth boundary, as designed; CI supplies the SSM token).

Operator prerequisites

• Done: the SLACK_DRIFT_WEBHOOK_URL Workflow Builder trigger reshaped to declare Text variables title + body (was message/repo/run_url/report); both flows + the stage-3 ping use it.
• Before first verify run: set repository variable VERIFY_AGENT_ENABLED=true. The first run should be supervised (real applies under an admin token).

Notes / residual

• GITHUB_TOKEN pushes don't re-trigger the PR's CI (re-run manually).
• tf-verify-pr<N> resources are retained for review and not auto-swept (one set per PR; pre-deleted on re-run).
• Weekly schedule: for the drift report and dropping the ref: preview-v3 checkout pins remain TODO for when v3 becomes main.

🤖 Generated with Claude Code

---

Note

High Risk
Stage 3 runs real terraform apply with a prod admin token and can push to PR branches; mis-guards or a bad dispatch could mutate live LD state or code outside intended scaffold PRs.

Overview
Drift reporting (stage 1) now emits JSON instead of markdown and replaces the single truncated Slack blob with multiple private-channel posts via a shared {title, body} Workflow Builder webhook: a category summary, one message per new API family (paths + scaffold dispatch link/CLI), one per scaffoldable net-new resource in a partial family, and informational posts for unclaimed ops. Public logs still only show yes/no drift.

Scaffold (stage 2) gains optional resource_name / operations inputs for scoped net-new resources, validation when scoped mode is incomplete, and agent prompts/branches/mapping instructions that follow whole-family vs scoped behavior.

New verify-scaffold.yml (stage 3) is a workflow_dispatch flow that guards same-repo open scaffold/* PRs, loads a prod LD token via AWS OIDC/SSM, builds the provider with a pinned GOBIN terraform dev override, pre-deletes tf-verify-pr<N> projects, runs a verification agent (real plan/apply, optional fixes pushed to the branch), and notifies Slack from verify-result.json.

Unrelated to autogen: generated vercel-native integration config adds an optional url field.

^{Reviewed by Cursor Bugbot for commit 5c81a79. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 883a602. Configure here.}