fix(#1774): update stale registry ref to conforma

[fullsend-ai-coder]

Update hack/update-infra-deployments.sh to use the conforma registry instead of the old enterprise-contract registry:

• Change TASK_POLICY_REF from quay.io/enterprise-contract/ec-task-policy
  to quay.io/conforma/task-policy (dropping the ec- prefix per naming
  convention)
• Update the sed match pattern to handle both old (ec-task-policy) and
  new (task-policy) image names in infra-deployments YAML files

---

Closes #1774

Post-script verification

• Branch is not main/master (agent/1774-update-stale-registry-ref)
• Secret scan passed (gitleaks — cfe02d00ddacd1a6c574f6a52d51da2c47d7b0ab..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:26 PM UTC · Completed 12:31 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review — ✅ Approve

PR: fix(#1774): update stale registry ref to conforma
Scope: 1 file changed (hack/update-infra-deployments.sh), 2 additions, 2 deletions

Summary

Clean, well-scoped change that updates the last hardcoded enterprise-contract registry reference in hack/update-infra-deployments.sh to the conforma equivalent. Directly addresses issue #1774.

Changes reviewed

1. TASK_POLICY_REF update (line 30): Registry reference changed from quay.io/enterprise-contract/ec-task-policy:latest → quay.io/conforma/task-policy:latest. Follows the project's naming convention (drops ec- prefix under the conforma org).

2. Sed match pattern update (line 79): The BRE regex pattern now makes the ec- prefix optional via \(ec-\)\{0,1\}, enabling the script to match both old-format (ec-task-policy) and new-format (task-policy) image references in infra-deployments YAML files. This provides backward compatibility during the transition period.

Verification

• ✅ Regex correctness: Verified the BRE \(ec-\)\{0,1\} pattern correctly matches both ec-task-policy:* and task-policy:* paths
• ✅ Scope guard: The update_ecp_resources function filters to EnterpriseContractPolicy YAML resources only (via yq at line 63), so the broader regex has no risk of unintended matches
• ✅ No missed references: Confirmed ec-task-policy only appears in this file (lines 30, 79) — the other enterprise-contract references in hack/update-bundles.sh and .github/workflows/push-bundles.yaml are part of the intentional dual-push infrastructure
• ✅ Issue alignment: Change directly matches issue Update stale enterprise-contract reference in hack/update-infra-deployments.sh #1774's proposed fix
• ✅ No security concerns: Registry reference update only, no new functionality or privilege changes

No blocking findings.

---

Labels: PR modifies tooling script in hack/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unit-tests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 4:51 PM UTC · Completed 5:01 PM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #1775 — update stale registry ref to conforma

What happened

This PR demonstrates the fullsend agent pipeline working end-to-end with zero rework, originating from a retro-filed issue:

1. PR Update quay.io references from enterprise-contract to conforma #1771 (human-authored) merged on Jul 14, migrating quay.io references from enterprise-contract to conforma.
2. Retro agent (run 29331822324) identified a stale reference missed by PR Update quay.io references from enterprise-contract to conforma #1771 in hack/update-infra-deployments.sh and filed issue #1774 — 8 minutes after merge.
3. Triage agent classified it as low-severity tooling bug and applied ready-to-code — completed in ~4 minutes.
4. Code agent (run 29332053136) created PR #1775 with a 2-line fix updating the registry reference and making the sed pattern backward-compatible — completed in ~7 minutes.
5. Review agent (run 29332489683) approved with a substantive review verifying regex correctness, scope guards, and no missed references — completed in ~5 minutes.
6. Human reviewer (simonbaird) approved and merged 28 days later on Aug 11 with no additional comments.

Total agent pipeline time: ~16 minutes. Total time to merge: ~28 days.

Assessment

Agent pipeline quality: Excellent. All four agents (retro, triage, code, review) performed well. The code agent's fix was correct on the first attempt — no fix runs were needed. The review agent provided structured analysis covering regex correctness, scope safety, codebase-wide reference checks, and issue alignment. The retro-to-merge chain demonstrates the system's self-improvement capability working as designed.

Time to resolution: Significant gap. The 28-day wait for human review is the primary inefficiency. Analysis of recent merged PRs in conforma/policy reveals this is a systematic pattern for agent-authored PRs:

• Agent PRs fix(#1774): update stale registry ref to conforma #1775 and fix(#1768): remove stale .adoc files before doc generation #1769 both waited ~28-29 days to merge
• Two more agent PRs (docs(#1750): document result format and result_helper functions #1754, docs(#1753): add default values section to CVE package docs #1756) have been open with ready-for-merge for 53+ days
• By contrast, human-authored PRs typically merge in 1-12 days
• 16 PRs currently carry the ready-for-merge label, including 10 Renovate PRs (oldest: 203 days)

Evidence for existing issues (no new proposals needed)

All identified gaps are covered by existing open issues:

• Proactive staleness alert for fully-approved ready-for-merge PRs fullsend-ai/fullsend#2004 (staleness alerts): PR fix(#1774): update stale registry ref to conforma #1775 is another data point — a fully agent-approved size: XS PR sat 28 days with ready-for-merge. The pattern extends to 4 agent PRs in conforma/policy with 28-53+ day waits.
• Track autonomy readiness: review agent fully covered human review on docs-only rename PR in conforma/policy #1771 fullsend-ai/fullsend#4765 (autonomy readiness for conforma/policy): The review agent's analysis was substantive (5-point verification checklist, regex validation, scope-guard confirmation), while the human approval included no additional comments. This PR broadens the evidence from doc-only changes to simple tooling/shell-script changes.
• internal/config: defaults.auto_merge is parsed but never consumed fullsend-ai/fullsend#5808 (auto_merge config dead code): conforma/policy has an auto-merge workflow (auto-merge.yaml) but the harness auto_merge config field is never consumed. Wiring this up would be the most direct path to reducing the 28-day wait for well-scoped agent PRs.
• feat(review): add confidence annotation to review verdicts fullsend-ai/fullsend#5514 (confidence annotations): A confidence-annotated review verdict would enable graduated auto-merge — this PR's size: XS, single-file, backward-compatible change is exactly the class that should qualify for high-confidence auto-merge.

No proposals filed

The workflow executed cleanly with no quality issues. The sole inefficiency (time-to-merge for agent PRs) is well-covered by existing issues. Filing new proposals would be duplicative.