Wire the deterministic coordinator to one isolated agent worker per reserved PR. Reconciliation runs on PR/CI events and every 15 minutes. Threat detection must succeed before a fresh trusted job validates and publishes a proposal; ordinary CI confirms the new head.

The new writer is disabled by default. Enabling it gates off the old rebase and CI-fixer writers. Rollout requires signed-state provisioning and main-based canaries; non-main bases stop with a human blocker until recorded stack replay boundaries are supported. Humans retain merge control.

Validation: both agentic workflows compiled with pinned gh-aw v0.86.2 in strict mode; compiled permissions, artifact flow, detector gating, and trusted-main checkouts independently reviewed. Full maintenance tests and repository CI/type checks pass locally; live canary validation follows merge.

Security review: the compiler references existing Codex/OpenAI engine credentials, the new `PR_MAINTENANCE_STATE_KEY`, and existing `PR_MAITENANCE_TOKEN`. Engine credentials remain in the managed engine boundary; the state key is scoped to trusted preparation/application steps, and the write token is scoped to the trusted application step. New Actions dependencies are official actions pinned in the lock file; the privileged coordinator uses pinned checkout/setup actions. No new redirects or credential destinations were added. Existing writers must finish or be cancelled before enabling the new coordinator.