ci: move argus to the aao secretariat app identity

[bokelley]

What changed

Migrates the Argus AI-review workflow from the IPR GitHub App identity to the new AAO Secretariat GitHub App, mirroring the spec repo migration in adcontextprotocol/adcp#5832.

• .github/workflows/ai-review.yml
  • Both App-token minting steps (paused-notice token and review-posting token) now use org-level ${{ secrets.SECRETARIAT_APP_ID }} / ${{ secrets.SECRETARIAT_APP_PRIVATE_KEY }} instead of IPR_APP_ID / IPR_APP_PRIVATE_KEY.
  • Header comments now describe Argus as the AAO Secretariat's review desk applying the WG constitution, rather than reviewing in a person's voice.
  • The prompt-building step fetches the WG constitution from the spec repo at review time (https://raw.githubusercontent.com/adcontextprotocol/adcp/main/.agents/wg/constitution.md) and appends it to the reviewer prompt under a ## WG constitution (from adcontextprotocol/adcp@main) heading — only when the fetch returns content. The constitution is never read from this repo or from the PR.
  • Prompt loading was already pinned to the PR's base SHA with a fail-closed git cat-file -e check (checkout is fetch-depth: 0 on the base SHA), so no change was needed there.
  • This repo has no hardcoded bot-login pin: the review-verification step derives the login from the minted token's app-slug output, so it follows the new App automatically (aao-secretariat[bot]).
• .github/ai-review/expert-adcp-reviewer.md
  • Replaced the personal-voice identity clause: Argus is the review desk of the AAO Secretariat serving the AdCP Working Group; it applies the WG constitution appended to the prompt and cites decision records (DR-NNNN in the spec repo's governance/decisions/) when a question is settled precedent. Repo-specific review logic (D-decision audits, MUST FIX bar, expert delegation) is untouched.

ipr-agreement.yml, release/publish workflows, and sync-agent-roles are untouched.

After merge

Argus reviews on this repo will post as aao-secretariat[bot] instead of aao-ipr-bot[bot].

⚠️ DO NOT MERGE yet

Do not merge until the org-level SECRETARIAT_APP_ID / SECRETARIAT_APP_PRIVATE_KEY secrets are visible to this repository, or Argus reviews will stop (token minting will fail on every PR).

The WG constitution is fetched from adcontextprotocol/adcp@main at review time; if the fetch fails, the review proceeds without the constitution section rather than failing the run.

Validation

• python3 -c "import yaml;yaml.safe_load(open('.github/workflows/ai-review.yml'))" — passes
• bash -n on the modified prompt-building shell block — passes
• npx commitlint --from HEAD~1 --to HEAD and scripts/check-pr-title.cjs — pass

Note: this PR touches Argus's own configuration, so the self-modification gate will pause Argus on it — a human review is required by design.

🤖 Generated with Claude Code

[aao-ipr-bot]

🛑 Argus paused on this PR.

This PR modifies Argus's own configuration (.github/workflows/ai-review.yml or .github/ai-review/**). Argus will not post an approving review on changes to its own gates — a human reviewer must take this PR.

Workflow run

_{Automated by the Argus self-modification gate.}