Harden unskip closed tests workflow

.github/agents/unskip-closed-tests.agent.md

@@ -0,0 +1,50 @@
+---
+name: unskip-closed-tests
+description: "Selects only source-bound, deterministically eligible .NET Ignore sites for trusted revalidation and test execution."
+---
+
+# Unskip Closed Tests Planner
+
+You are a read-only planner. The trusted manifest is the sole authority for
+source sites, containing declarations, test FQNs, tracking identities, remote
+eligibility, and revision freshness.
+
+## Required process
+
+1. Read `GH_AW_UNSKIP_MANIFEST` with `jq`.
+2. Require its `schema_version`, `source_commit`, and `manifest_digest` to equal
+   the trusted environment values.
+3. Consider only candidates where `decision.eligible` is `true`.
+4. Inspect the source only at each candidate's recorded repository-relative
+   path and span. Use it to identify ambiguity, never to create a replacement
+   identity.
+5. Defer class-level sites unless the manifest already enumerates every
+   affected `owner.test_fqns` entry and has no class-level deferral.
+6. Select only IDs copied byte-for-byte from `candidate_id`.
+7. Call exactly one allowed output and stop.
+
+## Mandatory deferrals
+
+Defer any candidate when:
+
+- its source path, span, owner, containing type chain, declaration identity,
+  test FQN, issue identity, or state appears inconsistent;
+- a method's recorded owner is not its actual syntax ancestor;
+- class-level inheritance, nesting, partial declarations, or incomplete test
+  enumeration is present;
+- issue context does not clearly correspond to the ignored test even though
+  the deterministic remote state is eligible;
+- the candidate depends on an inferred anchor, source rewrite, or remote fact.
+
+Never infer accessibility, issue state, PR merge state, containing types,
+method identities, or tests affected by a class-level attribute.
+
+## Output
+
+For one or more selected candidates, call `apply_verified_unskips` once with
+the exact manifest digest and a JSON array string of unique candidate IDs. The
+safe-output job may retain fewer candidates after source, remote, build, and
+TRX revalidation.
+
+When no candidate remains, call `noop` once. Do not edit files, run builds or
+tests, create a patch, construct a PR body, or call any other output.

.github/workflows/README.md

@@ -349,7 +349,7 @@ the cause.
 | [`resource-lock-refactoring.md`](./resource-lock-refactoring.md) | Daily + manual | Prepares one bounded test project for safe parallel execution by eliminating shared state or applying the narrowest appropriate `[ResourceLock]`, then opens a draft PR. |
 | [`repository-quality-improver.md`](./repository-quality-improver.md) | Weekday schedule + manual | Daily analysis of repository quality, rotating focus areas. Opens tracking issues like this one. |
 | [`daily-file-diet.md`](./daily-file-diet.md) | Daily + manual | Identifies oversized source files and opens actionable refactoring issues. |
-| [`unskip-closed-tests.md`](./unskip-closed-tests.md) | Weekly + manual | Finds tests skipped via `[Ignore("…#issue")]` whose tracking issue is now closed, verifies they pass, and opens a PR re-enabling them. |
+| [`unskip-closed-tests.md`](./unskip-closed-tests.md) | Weekly + manual | Builds a source-bound Ignore inventory at the exact commit, accepts only completed issues or merged PRs, and opens one draft PR only for tests proven executed and passed in structured TRX results. |
 | [`duplicate-code-detector.md`](./duplicate-code-detector.md) | Schedule + manual | Identifies duplicate code patterns and suggests refactoring opportunities. |
 | [`malicious-code-scan.md`](./malicious-code-scan.md) | Schedule + manual | Reviews code changes from the last 3 days for suspicious patterns indicating malicious or agentic threats. |
 | [`markdown-linter.md`](./markdown-linter.md) | Schedule + manual | Runs Markdown quality checks using markdownlint-cli2 and opens issues for violations. |

.github/workflows/test-unskip-closed-tests.yml

@@ -0,0 +1,50 @@
+name: Test unskip closed tests helper
+
+on:
+  pull_request:
+    paths:
+      - '.github/scripts/test_unskip_closed_tests_verify.ps1'
+      - '.github/agents/unskip-closed-tests.agent.md'
+      - '.github/workflows/unskip-closed-tests.config.json'
+      - '.github/workflows/unskip-closed-tests-prepare.md'
+      - '.github/workflows/unskip-closed-tests-shared.md'
+      - '.github/workflows/unskip-closed-tests-tool/**'
+      - '.github/workflows/unskip-closed-tests-verify.ps1'
+      - '.github/workflows/test-unskip-closed-tests.yml'
+      - '.github/workflows/unskip-closed-tests.md'
+  push:
+    branches:
+      - main
+      - 'rel/*'
+    paths:
+      - '.github/scripts/test_unskip_closed_tests_verify.ps1'
+      - '.github/agents/unskip-closed-tests.agent.md'
+      - '.github/workflows/unskip-closed-tests.config.json'
+      - '.github/workflows/unskip-closed-tests-prepare.md'
+      - '.github/workflows/unskip-closed-tests-shared.md'
+      - '.github/workflows/unskip-closed-tests-tool/**'
+      - '.github/workflows/unskip-closed-tests-verify.ps1'
+      - '.github/workflows/test-unskip-closed-tests.yml'
+      - '.github/workflows/unskip-closed-tests.md'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: test-unskip-closed-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test unskip closed tests helper
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "8.0.x"
+      - run: pwsh -NoLogo -NoProfile -File .github/scripts/test_unskip_closed_tests_verify.ps1
+      - run: dotnet run --project Tests/UnskipClosedTests.Tool.Tests.csproj
+        working-directory: .github/workflows/unskip-closed-tests-tool