name: Temporary residual safety refactor

on:
  push:
    paths:
      - tools/apply_residual_safety_and_outputs_refactor.py
      - .github/workflows/temp-residual-safety-refactor.yml
  workflow_dispatch:

permissions:
  contents: write

jobs:
  apply:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install focused test dependency
        run: python -m pip install filelock
      - name: Apply residual fixes and safe extraction
        run: python tools/apply_residual_safety_and_outputs_refactor.py
      - name: Verify syntax
        run: python -m compileall -q grok_register_ttk.py registration_flow.py account_outputs.py cpa_xai tests
      - name: Run focused regression tests
        run: python -m unittest tests.test_registration_flow tests.test_pending_recovery tests.test_grok2api_remote_pool
      - name: Commit source changes and cleanup
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git rm -f tools/apply_residual_safety_and_outputs_refactor.py .github/workflows/temp-residual-safety-refactor.yml
          git add -A
          git commit -m "fix: harden residual flow boundaries and pending recovery"
          git push