feat(autopilot): PR Dependency Graph Resolver with tier labelling

[Copilot]

DRC agent recommended building a dependency chain resolver to surface PR blocking relationships across the three active repos. This adds autopilot/dependency_graph.py implementing the full pipeline.

Changes

.github/PULL_REQUEST_TEMPLATE.md

• Added a "Dependencies" section with Depends on #X / Depends on owner/repo#X syntax — the structured input the resolver reads

autopilot/dependency_graph.py

• Regex pre-pass — extracts Depends on #X patterns (case-insensitive, hyphen/underscore variants) at zero API cost; LLM only called when regex finds nothing
• LLM extraction — claude-3-5-haiku-20241022 with enforced JSON schema: {pr_id, repo, depends_on[], confidence_score}; skipped if confidence_score < 0.5
• NetworkX DAG — edge A → B = "A depends on B"; two-pass build (nodes first, then edges); cycle detection + breaking
• Tier assignment via in/out degree:
  • tier-0-blocker — has in-edges (others depend on it)
  • tier-1-dependent — has out-edges only (depends on others)
  • tier-2-leaf — isolated (no edges)
• Label management — creates labels if absent, removes stale tier labels before applying new one
• Dry-run by default; ENABLE_LIVE_MODE=true to write; max_llm_calls budget cap
• Scoped to 3 active repos: autonomous-github-agent, ai-automation-engine, github-multi-agent-system
• CLI: python autopilot/dependency_graph.py [--live] [--max-llm-calls N] [--no-llm]

requirements.txt

• Added networkx>=3.0

tests/unit/test_dependency_graph.py

• 46 unit tests covering regex extraction, LLM extraction (including fallback/fence-stripping), DAG construction, tier assignment, label application (dry-run + live), cycle breaking, and run() orchestration

# Example: regex picks up the dependency, no LLM call needed
body = "Depends on #42\nDepends on owner/repo#7"
extract_deps_regex(body)  # → [42, 7]

# Tier result for A → B → C:
#   A: tier-1-dependent  (depends on B, nobody depends on A)
#   B: tier-0-blocker    (A depends on it)
#   C: tier-0-blocker    (B depends on it)

[labgadget015-dotcom]

🤖 DRC Agent Analysis

Recommendation: 🟠 P1 IMPORTANT

Summary: Hybrid Regex-LLM DAG Engine with Tier Labelling (Dreamer ID 3, Realist recommended)

Next steps:

1. Step 1: Pin dependencies - add networkx>=3.0,<4.0 and anthropic>=0.25,<1.0 to requirements.txt with exact version bounds to prevent drift
2. Step 2: Implement Phase 1 MVP - regex-only DependencyGraphBuilder in autopilot/dependency_graph.py with cycle detection and tier labelling via nx.topological_generations(); ship and validate against real issue corpus before adding LLM layer
3. Step 3: Add llm_cache.py with SHA256 content-hash keying and TTL-based invalidation before wiring up Claude-haiku escalation to prevent runaway API costs
4. Step 4: Implement LLM escalation with conservative keyword trigger list and confidence >= 0.7 filter; log escalation rate to a local counter for first-week cost monitoring
5. Step 5: Write tests/unit/test_dependency_graph.py covering all 6 cases specified in Realist Step 11 before merging to main; use pytest-mock to stub Anthropic API calls

Strategic fit: Consulting: high · Product: high · Tech debt: reduces

---

Analysed by GadgetLab DRC Agent (Dreamer → Realist → Critic) · Run run_1783147066901

[labgadget015-dotcom]

🤖 DRC Agent Analysis

Recommendation: 🟠 P1 IMPORTANT

Summary: BugHunterAgent as Self-Validating Claude Tool-Use Loop (Dreamer ID 2) - recommended by REALIST as primary implementation path

Next steps:

1. Step 1: Implement Solution 1 (GitHub Actions Matrix Parallel Validator) first - 6h investment unblocks PR feat(autopilot): PR Dependency Graph Resolver with tier labelling #185 immediately with zero risk and establishes the CI foundation BugHunterAgent will run within
2. Step 2: Once Matrix Validator is green on PR feat(autopilot): PR Dependency Graph Resolver with tier labelling #185, begin BugHunterAgent implementation starting with autopilot/bug_hunter_agent.py - pin anthropic SDK version in pyproject.toml before writing any code
3. Step 3: Implement all 4 subprocess tool wrappers with timeout=600 and structured dict returns before writing the agent loop - test each tool wrapper independently with real subprocess calls
4. Step 4: Build agent loop with max 5 iterations and COMMENT-only PR review mode (no REQUEST_CHANGES) for initial deployment to prevent false-positive merge blocks
5. Step 5: Add token cost guard logging to GitHub Actions job summary and set anomaly threshold at 50k tokens per run

Strategic fit: Consulting: high · Product: high · Tech debt: neutral

---

Analysed by GadgetLab DRC Agent (Dreamer → Realist → Critic) · Run run_1783147356973

[github-actions]

📊 Code Complexity Analysis

Summary:

• Total Functions Analyzed: 801
• Average Complexity: 3.53
• High Complexity Functions: 26
• Low Maintainability Files: 58

⚠️ High Complexity Functions

These functions exceed the complexity threshold and should be refactored:

File	Function	Complexity	Line
core/risk_scorer.py	score_pull_request	35	141
autopilot/autopilot.py	generate_summary	24	195
autopilot/staleness_engine.py	process_stale_prs	16	281
autopilot/ai_optimization/performance_monitor.py	get_benchmark_stats	15	184
.github/scripts/weekly_digest.py	build_blocks	15	38
.github/scripts/metrics_collector.py	parse_workflow_metrics	14	148
.github/scripts/setup_branch_protection.py	main	14	240
.github/scripts/self_healing_system.py	analyze_failure_patterns	14	256
.github/scripts/ai_code_suggestor.py	_check_import_organization	14	113
.github/scripts/prometheus_exporter.py	collect_metrics	14	99

... and 16 more

Recommendations:

• Break down large functions into smaller, focused units
• Extract complex conditional logic into separate functions
• Use early returns to reduce nesting

🔧 Low Maintainability Files

These files have low maintainability scores and may need refactoring:

File	Score	Status
.github/scripts/health_dashboard_generator.py	28.14	🔴
.github/scripts/workflow_monitor.py	33.73	🔴
.github/scripts/ai_code_suggestor.py	33.76	🔴
.github/scripts/ai_workflow_optimizer.py	35.51	🔴
.github/scripts/performance_benchmark.py	39.46	🔴
.github/scripts/self_healing_system.py	40.27	🔴
.github/scripts/threshold_monitor.py	41.13	🔴
.github/scripts/parallel_code_analyzer_optimized.py	41.16	🔴
autopilot/autopilot.py	42.45	🔴
autopilot/ai_optimization/anomaly_detector.py	42.56	🔴
agents/triage_agent.py	42.79	🔴
.github/scripts/refactoring_assistant.py	43.03	🔴
autopilot/ai_optimization/intelligent_cache.py	43.28	🔴
autopilot/ai_optimization/commit_summarizer.py	44.05	🔴
.github/scripts/async_parallel_analyzer.py	44.47	🔴
autopilot/ai_optimization/performance_monitor.py	44.69	🔴
.github/scripts/badge_generator.py	45.28	🔴
.github/scripts/copilot_integration.py	45.37	🔴
.github/scripts/distributed_monitoring.py	45.53	🔴
.github/scripts/elite_copilot.py	45.69	🔴
autopilot/dependency_graph.py	45.74	🔴
agents/dependency_agent.py	45.76	🔴
.github/scripts/issue_auto_creator.py	46.39	🔴
.github/scripts/cost_calculator.py	46.4	🔴
.github/scripts/inline_pr_commenter.py	46.63	🔴
.github/scripts/complexity_reporter.py	46.78	🔴
.github/scripts/pr_triage.py	47.13	🔴
core/risk_scorer.py	48.15	🔴
autopilot/ai_optimization/nlp_relevance_filter.py	48.43	🔴
.github/scripts/pr_inline_commenter.py	48.47	🔴
autopilot/staleness_engine.py	48.73	🔴
.github/scripts/metrics_collector.py	48.91	🔴
.github/scripts/dependency_updater.py	48.91	🔴
autopilot/ai_optimization/ml_priority_scorer.py	49.53	🔴
.github/scripts/changelog_generator.py	49.75	🔴
.github/scripts/parallel_code_analyzer.py	49.96	🔴
autopilot/ai_optimization/api_optimizer.py	50.46	🟡
agents/security_scan_agent.py	51.04	🟡
.github/scripts/workflow_optimizer.py	51.67	🟡
.github/scripts/cot_selector.py	51.73	🟡
.github/scripts/release_manager.py	51.92	🟡
.github/scripts/llm_router.py	52.35	🟡
.github/scripts/auto_pr.py	52.72	🟡
.github/scripts/notification_manager.py	53.58	🟡
.github/scripts/prometheus_exporter.py	54.96	🟡
.github/scripts/weekly_digest.py	55.02	🟡
core/audit_logger.py	55.6	🟡
.github/scripts/gather_context.py	56.0	🟡
core/llm_provider.py	56.32	🟡
.github/scripts/streaming_results.py	56.64	🟡
.github/scripts/setup_branch_protection.py	57.0	🟡
.github/scripts/optimized_github_client.py	58.27	🟡
agents/orchestrator_agent.py	59.02	🟡
agents/code_review_agent.py	60.45	🟡
core/github_client.py	61.96	🟡
core/message_queue.py	63.22	🟡
core/agent_config.py	63.86	🟡
core/idempotency.py	64.45	🟡

Maintainability Index Guide:

• 🟢 85-100: Excellent maintainability
• 🟡 65-84: Good maintainability
• 🟠 50-64: Moderate maintainability (consider refactoring)
• 🔴 0-49: Poor maintainability (needs refactoring)

[github-actions]

🟡 Risk Assessment: MEDIUM (3.2/10)

Analysed 5 files, 1216+ / 0− lines. Security-sensitive paths detected. Test coverage unchanged or improved.

Scoring breakdown

Factor	Score
Change volume — 1216 lines changed	+1.2
Sensitive paths — 1 security-relevant files	+1.5
Draft PR — marked as draft	+0.5

⚠️ Security-sensitive paths modified

• requirements.txt

✅ Eligible for auto-merge (subject to CI passing).

[github-actions]

🔍 Pre-commit Checks

🔧 Pre-commit issues were automatically fixed and committed.

Please pull the latest changes before pushing again:

git pull origin copilot/fix-import-errors-bughunteragent-again

---

Pre-commit hooks help maintain code quality and consistency.

[github-actions]

🤖 Elite AI Copilot Analysis

Elite AI Copilot Analysis Report

Generated: 2026-07-04 06:45:11
Session ID: copilot_1783147511
Repository: .

🎯 Health Score: 100.0/100

🚀 Top Recommendations

1. ✅ Repository is in excellent shape - continue current practices

📊 Detailed Insights

Code Quality Baseline Established

• Category: code_quality
• Severity: info
• Description: Repository code quality metrics captured
• Suggested Action: Continue monitoring for regressions
• Confidence: 90%

Security Scan Initiated

• Category: security
• Severity: info
• Description: No critical vulnerabilities detected in initial scan
• Suggested Action: Enable continuous security monitoring
• Confidence: 85%

Repository Structure Analyzed

• Category: architecture
• Severity: info
• Description: Well-organized modular structure detected
• Suggested Action: Maintain separation of concerns
• Confidence: 80%

Performance Baseline Captured

• Category: performance
• Severity: info
• Description: Repository performance metrics recorded
• Suggested Action: Monitor for performance regressions
• Confidence: 75%

Documentation Structure Good

• Category: documentation
• Severity: info
• Description: Comprehensive documentation files present
• Suggested Action: Keep documentation in sync with code changes
• Confidence: 90%

---

Powered by Elite AI Copilot v1.0

[github-actions]

Code Quality Analysis ❌ FAILED

Duration: 0.01s
Total Issues: 10

Tool Results

• pylint: ❌
• flake8: ❌
• bandit: ❌
• radon_cc: ❌
• radon_mi: ❌

View detailed results

{
  "timestamp": "2026-07-04 06:45:11",
  "elapsed_seconds": 0.01,
  "summary": {
    "total_issues": 10,
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 0
  },
  "tools": {
    "pylint": {
      "status": "failed",
      "output": "",
      "errors": "Pylint error: [Errno 2] No such file or directory: 'pylint'"
    },
    "flake8": {
      "status": "failed",
      "output": "",
      "errors": "Flake8 error: [Errno 2] No such file or directory: 'flake8'"
    },
    "bandit": {
      "status": "failed",
      "output": "",
      "errors": "Bandit error: [Errno 2] No such file or directory: 'bandit'"
    },
    "radon_cc": {
      "status": "failed",
      "output": "",
      "errors": "Radon error: [Errno 2] No such file or directory: 'radon'"
    },
    "radon_mi": {
      "status": "failed",
      "output": "",
      "errors": "Radon MI error: [Errno 2] No such file or directory: 'radon'"
    }
  },
  "passed": false
}

[github-actions]

🔒 Security Scan Results

🛡️ Bandit Security Scan

• 🔴 HIGH: 0
• 🟡 MEDIUM: 9
• 🟢 LOW: 77

📦 Dependency Vulnerabilities

• Total vulnerable dependencies: 62

Vulnerable Dependencies:

• pygithub 2.9.1
• aiohttp 3.14.1
• multidict 6.7.1
• yarl 1.24.2
• pyyaml 6.0.3
• ... and 57 more

---

Security scans run automatically on every PR. View detailed reports in the Actions tab.

[labgadget015-dotcom]

🤖 DRC Agent Analysis

Recommendation: 🟠 P1 IMPORTANT

Summary: BugHunterAgent as Lightweight Import-Error Sentinel (Dreamer ID 3, Realist Recommended Solution)

Next steps:

1. Step 1: Before writing any code, run grep -r 'from dependency_graph' autopilot/ and verify dependency_graph.py exports a stable API — if unstable, proceed with Solution 3 independently (it has no dependency_graph.py dependency anyway)
2. Step 2: Implement autopilot/bug_hunter_agent.py with ImportSentinel class using ast.walk() over autopilot/ — use importlib.metadata.packages_distributions() for package resolution, not raw requirements.txt parsing
3. Step 3: Implement DFS circular import detection over the extracted import graph, explicitly skipping imports inside if TYPE_CHECKING: blocks and function bodies, flagging them as out-of-scope in the report
4. Step 4: Generate structured JSON health report with schema: {broken_imports: [{file, import_name, reason}], missing_packages: [str], circular_refs: [[str]], skipped_conditional_imports: [str]}
5. Step 5: Add GitHub Actions workflow step with ::error file={file},line={line}:: annotation syntax for broken imports — exit code 1 on any finding

Strategic fit: Consulting: medium · Product: high · Tech debt: reduces

---

Analysed by GadgetLab DRC Agent (Dreamer → Realist → Critic) · Run run_1783147455935