Route job should inherit org-level agent enabled/disabled when per-repo config omits agents key

[fullsend-ai-retro]

What happened

PR #4134 is a Konflux nudge PR on quay/quay-konflux-components. The org-level config at quay/.fullsend/config.yaml explicitly disables the review agent (name: review, enabled: false). However, the review agent ran on every synchronize and open event (10 times total across runs 31027914187 through 32395277600).

The cause is in the Route job of reusable-dispatch.yml. The agents validation step reads .fullsend/config.yaml from the target repo only. When quay/quay-konflux-components/.fullsend/config.yaml has no agents: key, yq '.agents | type' returns !!null, and the step exits early with exit 0 — skipping all agent-enabled checks. The subsequent agent-enabled check also finds no entries (yq '.agents[] | select(...)' returns nothing), so AGENT_ENABLED is empty (not "false"), and the review stage proceeds.

What could go better

The Route job should implement config inheritance: when the per-repo config omits the agents: key, the job should fall back to the org-level config at <org>/.fullsend/config.yaml to check agent enabled/disabled status. Currently, the absent key is treated as "no opinion" and defaults to enabled, which silently overrides the org's explicit disable.

Confidence: High. The mechanism is confirmed from the run logs — the !!null early exit is clearly visible in the validation step, and the org config's enabled: false on review is explicit. The per-repo config includes review in its roles: list but has no agents: key, so this is not an intentional per-repo override — it is an unintended gap in config inheritance.

This is related to but distinct from #4529 (which documents a bypass via role-to-meta-role mapping for retro/prioritize). Both are config inheritance bugs, but they operate through different code paths. Design issues #84 and #195 describe the broader config inheritance model that would prevent both classes of bugs.

Proposed change

In fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml, modify the agents validation and agent-enabled check steps in the Route job to implement a two-tier config lookup:

1. In the agents validation step, when the per-repo config's agents type is !!null or empty, instead of exiting early, fall through to check the org-level config (<org>/.fullsend/config.yaml).
2. In the agent-enabled check step, if the per-repo config yields no match for the current stage, check the org-level config for agents[] | select(.name == "$STAGE") | .enabled.
3. Only default to enabled if neither config level has an entry for the agent.

This preserves the ability for per-repo configs to explicitly override org-level settings (when they include an agents: key) while ensuring org-level disables are respected when the per-repo config is silent on the topic.

Validation criteria

After the fix: (1) A fullsend workflow run on quay/quay-konflux-components should skip the review stage with a log message like "Stage 'review' skipped — agent disabled in org config". (2) If the per-repo config adds agents: [{name: review, enabled: true}], review should run (per-repo override honored). (3) Other repos under quay/ that already have per-repo agents: lists should be unaffected. Verify on the next 3 Konflux nudge PRs to quay/quay-konflux-components.

---

Generated by retro agent from https://github.com/quay/quay-konflux-components/pull/4134