[fullsend-ai-coder]

Summary

First step in splitting triage/write access by repo group, starting with the fullsend group (fullsend, agents, experiments).

• peribolos.yaml
  • Adds fullsend-triagers (triage) and fullsend-writers (write) on fullsend, agents and experiments. Both are privacy: closed, have ralphbean as maintainer, and copy every current member of triagers / writers.
  • Removes the fullsend and agents grants from triagers and writers. Both teams keep their other repos, and writers keeps .fullsend.
• .github/ISSUE_TEMPLATE/triage-request.yml, write-request.yml: the maintainer approval steps now name the new teams. These templates were moved here from fullsend's discussion templates (fullsend-ai/fullsend@faefa73e), so this covers item 3 of the issue.

Current members keep their access to fullsend and agents. experiments is newly open to the group, as the issue intends.

Expected peribolos dry run

• Create fullsend-triagers and fullsend-writers, with their members and their 3 repo grants each.
• Remove 4 grants: fullsend and agents from triagers, and the same two from writers.
• Nothing else.

Testing

• python3 scripts/lint.py: passes.
• Checked with a script that the member and maintainer lists of each new team match its old team exactly.
• Not run: the peribolos dry run. It needs a prow checkout and an org token, so it must be checked on this PR.

Follow-ups (not in this PR)

• LADDER.md in fullsend-ai/fullsend: point the Triage and Write "How to check" sections at the new teams.
• .github/workflows/notify-role-request-slack.yml still tells people to add requesters to triagers / writers. The agent cannot edit workflow files, so a maintainer needs to update it.

🤖 Generated with Claude Code

---

Closes #1

Post-script verification

• Branch is not main/master (agent/1-fullsend-group-teams)
• Secret scan passed (gitleaks — 71dbd7cd4210cd3ce1f99b58ff3a75850fd51e11..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Final PR description secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:07 PM UTC · Completed 12:16 PM UTC

Commit: 30477de · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.42

[fullsend-ai-review]

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Small scoped change aligning with issue requirements, elevated to moderate risk due to touching protected paths and total-state peribolos.yaml which exhibits recent churn and regression history.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/ISSUE_TEMPLATE/triage-request.yml, .github/ISSUE_TEMPLATE/write-request.yml — This PR modifies files under the protected path .github/. The PR links issue Split triagers/writers into per-repo-group teams, starting with the fullsend group #1 and explains the rationale (maintainer approval steps now name the new teams), but human approval is always required for protected-path changes, regardless of context.

• [stale-reference] .github/workflows/notify-role-request-slack.yml:47 — The Slack notification still tells maintainers to add triage requesters to triagers (line 52 does the same for writers). After this PR, those teams no longer grant access to fullsend/agents, so following the notification would grant the requester the old teams' other repos instead of the fullsend group, contradicting the updated issue forms. The PR description acknowledges this and defers it as a follow-up because the coder bot cannot edit workflow files.
  Remediation: In a follow-up PR by a maintainer, update the two branches to name fullsend-triagers and fullsend-writers; ideally merge it together with this PR so the notification and templates do not diverge.

[waynesun09]

Checked the member lists against main: fullsend-triagers and fullsend-writers copy triagers (18) and writers (9) exactly, ralphbean is the maintainer on both, and the old teams keep their remaining repos (.fullsend stays on writers). The diff matches #1.

Two things before merge:

1. The peribolos-dry-run failure comes from the new teams, not from a config error. In dry-run, CreateTeam does nothing, so the next call on fullsend-triagers returns 404 and the run stops (log). The plan it printed before that is right (2 creates, 4 RemoveTeamRepoBySlug), but fullsend-writers is never checked. The log also shows the old teams' grants are removed before the new teams get theirs. If the apply fails in between, current members lose fullsend/agents access until someone re-runs it. Suggest two PRs: this one adds the two teams only; a second removes the four old grants, and its dry run will pass and show exactly those removals.

2. Land the follow-ups in the same window. notify-role-request-slack.yml (needs a maintainer, the bot can't edit workflows) and LADDER.md in fullsend. LADDER says "the ladder is organization-wide" and points at triagers/writers; after this PR a role is per repo group, so the request templates probably need a repo-group choice too.