From dfe55fa1e8c16e6d8b3ffd94837c877b24542db2 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Fri, 31 Jul 2026 16:59:48 -0400
Subject: [PATCH 01/15] refactor: Wire dep-bump-scanner to org profile

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/dep-bump-scanner.sh | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/scripts/dep-bump-scanner.sh b/scripts/dep-bump-scanner.sh
index f8e878e..b659c23 100644
--- a/scripts/dep-bump-scanner.sh
+++ b/scripts/dep-bump-scanner.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # =============================================================================
-# Dependency Bump Scanner — rossoctl org
+# Dependency Bump Scanner
 # Monitors Dependabot PRs, classifies by severity, flags SLA breaches,
 # creates/closes GitHub issues, writes reports.
 #
@@ -21,14 +21,13 @@ source "$SCRIPT_DIR/program-lib.sh"
 # --- CLI args ---
 DRY_RUN=false
 ISSUE_LIMIT=0  # 0 = unlimited
-ORG="rossoctl"  # display/report-tag only; repo reads use canonical rossoctl/<name> (see get_core_repos)
 SHOW_HELP=false
 
 while [[ $# -gt 0 ]]; do
   case $1 in
     --dry-run) DRY_RUN=true; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
-    --org) ORG="$2"; shift 2 ;;
+    --org) ORG_FLAG="$2"; shift 2 ;;
     --help|-h) SHOW_HELP=true; shift ;;
     *) echo "Unknown option: $1"; exit 1 ;;
   esac
@@ -44,7 +43,7 @@ USAGE:
 OPTIONS:
   --dry-run         Scan and report only; do not create/close issues
   --issue-limit N   Create at most N issues per run (0 = unlimited)
-  --org NAME        GitHub org to scan (default: rossoctl)
+  --org NAME        GitHub org to scan (default: from profile, config/org.env)
   --help, -h        Show this help
 
 ENVIRONMENT:
@@ -64,6 +63,10 @@ USAGE
   exit 0
 fi
 
+# Resolve org identity (--org > env > profile > default). Sets ORG, FORK_OWNER,
+# MAIN_REPO, REPOS_DIR, REMAP. Repo reads use canonical $ORG/<name>.
+load_org_profile
+
 # --- Configuration ---
 validate_repos_dir "${REPOS_DIR:-}"
 
@@ -159,7 +162,7 @@ for repo_dir in "$REPOS_DIR"/*/ "$REPOS_DIR"/.github/; do
   # Strip trailing comma
   ecosystems="${ecosystems%,}"
 
-  # Store the canonical repo name so Step 2 builds correct rossoctl/<name> refs.
+  # Store the canonical repo name so Step 2 builds correct $ORG/<name> refs.
   jq -nc --arg repo "$canon" --arg eco "$ecosystems" \
     '{repo: $repo, ecosystems: ($eco | split(",") | map(select(. != "")))}' \
     >> "$TMPDIR/ecosystems.jsonl"
@@ -177,7 +180,7 @@ TOTAL_OPEN_PRS=0
 
 while IFS= read -r eco_record; do
   repo_name=$(echo "$eco_record" | jq -r '.repo')   # canonical name from Step 1
-  full_repo="rossoctl/$repo_name"
+  full_repo="$ORG/$repo_name"
 
   echo "  Checking $repo_name..."
 
@@ -434,7 +437,7 @@ while IFS='|' read -r issue_repo issue_pr_number; do
   overdue=$((age_days - sla_days))
 
   # Record repos are canonical names (see Step 1); build canonical refs.
-  full_repo="rossoctl/$issue_repo"
+  full_repo="$ORG/$issue_repo"
 
   # Deduplication
   search_term="[dep-bump] Stale $severity bump: $package in $issue_repo"
@@ -513,7 +516,7 @@ ISSUES_CLOSED=0
 while IFS='|' read -r fix_repo fix_pr_number; do
   [ -z "$fix_repo" ] && continue
 
-  full_repo="rossoctl/$fix_repo"
+  full_repo="$ORG/$fix_repo"
 
   # Find matching open issue by searching for the PR number in title/body
   issue_number=$(gh issue list --repo "$full_repo" \

From f486d1cda51314b4dc0bbd611862256af1251b2a Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Mon, 3 Aug 2026 10:11:07 -0400
Subject: [PATCH 02/15] refactor: Wire pr-review scanner and impact to profile

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/pr-review-impact.sh  |  4 +++
 scripts/pr-review-scanner.sh | 52 ++++++++++++++++++++----------------
 2 files changed, 33 insertions(+), 23 deletions(-)

diff --git a/scripts/pr-review-impact.sh b/scripts/pr-review-impact.sh
index 4c4c873..88a1a4b 100755
--- a/scripts/pr-review-impact.sh
+++ b/scripts/pr-review-impact.sh
@@ -90,6 +90,10 @@ USAGE
   exit 0
 fi
 
+# Resolve org identity (env > profile > default) before reading the allowlist;
+# get_core_repos() prepends $ORG and fails loud if it is unset.
+load_org_profile
+
 # --- Workspace and reports setup ---
 setup_workspace "pr-review-impact"
 WORK_DIR="$PROGRAM_TMPDIR"
diff --git a/scripts/pr-review-scanner.sh b/scripts/pr-review-scanner.sh
index b68a39f..46400db 100755
--- a/scripts/pr-review-scanner.sh
+++ b/scripts/pr-review-scanner.sh
@@ -11,29 +11,6 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/program-lib.sh"
 
-# --- Configuration ---
-BOT_USER="clawgenti"
-
-# Repo coverage comes from the shared allowlist (config/core-repos.txt) via
-# get_core_repos(). Build the array with a portable while-read loop (mapfile is
-# bash 4+, unavailable on macOS's bash 3.2). Fail loud rather than silently
-# scanning an empty set.
-REPOS=()
-while IFS= read -r repo_line; do
-  [ -n "$repo_line" ] && REPOS+=("$repo_line")
-done < <(get_core_repos)
-
-if [ "${#REPOS[@]}" -eq 0 ]; then
-  echo "ERROR: core repos allowlist is empty or could not be loaded" >&2
-  exit 1
-fi
-
-LABEL="ready-for-ai-review"
-REVIEW_MARKER="<!-- reviewed:"
-STALE_THRESHOLD_MIN=30
-TTL_DAYS=30
-MAX_HISTORY_ROWS=500
-
 # --- CLI args ---
 VERBOSE=false
 DRY_RUN=false
@@ -49,6 +26,8 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+# Short-circuit --help before loading a profile or reading the allowlist, so
+# usage works even in a checkout with a missing/malformed org profile.
 if [ "$SHOW_HELP" = true ]; then
   cat << 'USAGE'
 pr-review-scanner -- Discover PRs needing AI review
@@ -77,6 +56,33 @@ USAGE
   exit 0
 fi
 
+# Resolve org identity (env > profile > default) before reading the allowlist;
+# get_core_repos() prepends $ORG and fails loud if it is unset.
+load_org_profile
+
+# --- Configuration ---
+BOT_USER="clawgenti"
+
+# Repo coverage comes from the shared allowlist (config/core-repos.txt) via
+# get_core_repos(). Build the array with a portable while-read loop (mapfile is
+# bash 4+, unavailable on macOS's bash 3.2). Fail loud rather than silently
+# scanning an empty set.
+REPOS=()
+while IFS= read -r repo_line; do
+  [ -n "$repo_line" ] && REPOS+=("$repo_line")
+done < <(get_core_repos)
+
+if [ "${#REPOS[@]}" -eq 0 ]; then
+  echo "ERROR: core repos allowlist is empty or could not be loaded" >&2
+  exit 1
+fi
+
+LABEL="ready-for-ai-review"
+REVIEW_MARKER="<!-- reviewed:"
+STALE_THRESHOLD_MIN=30
+TTL_DAYS=30
+MAX_HISTORY_ROWS=500
+
 # --- Workspace and reports setup ---
 setup_workspace "pr-review-scanner"
 TMPDIR="$PROGRAM_TMPDIR"

From b6f98187a07afae6a75bef551f9fa960fbdb86c3 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Mon, 3 Aug 2026 13:26:02 -0400
Subject: [PATCH 03/15] refactor: Wire dep-bump-fixer to org profile

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/dep-bump-fixer.sh | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/scripts/dep-bump-fixer.sh b/scripts/dep-bump-fixer.sh
index 69775df..f0e7170 100644
--- a/scripts/dep-bump-fixer.sh
+++ b/scripts/dep-bump-fixer.sh
@@ -20,7 +20,6 @@ source "$SCRIPT_DIR/program-lib.sh"
 # --- CLI args ---
 DRY_RUN=true  # Safe by default
 ISSUE_LIMIT=15
-ORG="kagenti"
 VERBOSE=false
 SHOW_HELP=false
 
@@ -29,7 +28,7 @@ while [[ $# -gt 0 ]]; do
     --dry-run) DRY_RUN=true; shift ;;
     --live) DRY_RUN=false; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
-    --org) ORG="$2"; shift 2 ;;
+    --org) ORG_FLAG="$2"; shift 2 ;;
     --verbose) VERBOSE=true; shift ;;
     --help|-h) SHOW_HELP=true; shift ;;
     *) echo "Unknown option: $1"; exit 1 ;;
@@ -47,7 +46,7 @@ OPTIONS:
   --dry-run         Analyze and preview comments only (default)
   --live            Post comments on PRs and issues
   --issue-limit N   Process at most N issues (default: 5)
-  --org NAME        GitHub org (default: kagenti)
+  --org NAME        GitHub org (default: from profile, config/org.env)
   --verbose         Print additional diagnostic output
   --help, -h        Show this help
 
@@ -61,6 +60,11 @@ USAGE
   exit 0
 fi
 
+# Resolve org identity (--org > env > profile > default). Sets ORG, FORK_OWNER,
+# MAIN_REPO, REPOS_DIR, REMAP. Reads use canonical $ORG/<name>; write paths
+# (fork PRs) derive from $ORG/$FORK_OWNER.
+load_org_profile
+
 # --- Configuration ---
 validate_repos_dir "${REPOS_DIR:-}"
 
@@ -68,7 +72,6 @@ REPORTS_DIR="${REPORTS_DIR:-./reports/dep-bump}"
 SCAN_DATE=$(date -u +"%Y-%m-%d")
 SCAN_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 MAX_HISTORY_ROWS=500
-FORK_OWNER="clawgenti"
 FIXER_SIGNATURE="Automated analysis by Kagenti Dep Bump Fixer"
 
 # --- Workspace setup ---
@@ -111,7 +114,7 @@ if [ ! -f "$REPORTS_DIR/baseline.json" ]; then
     esac
     SEEN_CANON="$SEEN_CANON $canon"
 
-    gh pr list --repo "rossoctl/$canon" \
+    gh pr list --repo "$ORG/$canon" \
       --author "app/dependabot" \
       --state merged \
       --json number,createdAt,mergedAt \
@@ -179,7 +182,7 @@ for repo_dir in "$REPOS_DIR"/*/ "$REPOS_DIR"/.github/; do
   SEEN_CANON="$SEEN_CANON $canon"
 
   REPOS_CHECKED=$((REPOS_CHECKED + 1))
-  full_repo="rossoctl/$canon"
+  full_repo="$ORG/$canon"
 
   issues_json=$(gh issue list --repo "$full_repo" \
     --search "[dep-bump] in:title" \
@@ -554,7 +557,7 @@ for repo_dir in "$REPOS_DIR"/*/ "$REPOS_DIR"/.github/; do
   esac
   SEEN_CANON_TTM="$SEEN_CANON_TTM $canon"
 
-  gh pr list --repo "rossoctl/$canon" \
+  gh pr list --repo "$ORG/$canon" \
     --author "app/dependabot" \
     --state merged \
     --json number,createdAt,mergedAt \

From f68c1fb116562829882e07a4941aef59a5d11879 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Mon, 3 Aug 2026 14:25:06 -0400
Subject: [PATCH 04/15] fix: Wire link-health-fixer to profile, fix repo prefix

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/link-health-fixer.sh | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/scripts/link-health-fixer.sh b/scripts/link-health-fixer.sh
index 17599fc..1132357 100755
--- a/scripts/link-health-fixer.sh
+++ b/scripts/link-health-fixer.sh
@@ -11,10 +11,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/program-lib.sh"
 
 # --- Configuration ---
-REPOS_DIR="${REPOS_DIR:-$HOME/kagenti}"
 REPORTS_DIR="${REPORTS_DIR:-$HOME/workspaces/clawgenti/reports/link-scan}"
-FORK_OWNER="clawgenti"
-ORG="kagenti"
 FIX_DATE=$(date +%Y-%m-%d)
 SCAN_DATE=$(date +%Y-%m-%d)
 
@@ -35,11 +32,19 @@ while [[ $# -gt 0 ]]; do
     --live) DRY_RUN=false; shift ;;
     --dry-run) DRY_RUN=true; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
+    --org) ORG_FLAG="$2"; shift 2 ;;
+    --fork-owner) FORK_OWNER_FLAG="$2"; shift 2 ;;
+    --repos-dir) REPOS_DIR_FLAG="$2"; shift 2 ;;
     --verbose) VERBOSE=true; shift ;;
     *) echo "Unknown option: $1"; exit 1 ;;
   esac
 done
 
+# Resolve org identity (--flag > env > profile > default). Sets ORG, FORK_OWNER,
+# MAIN_REPO, REPOS_DIR, REMAP. Reads use canonical $ORG/<name>; fork-PR write
+# paths derive from $ORG/$FORK_OWNER.
+load_org_profile
+
 # --- Workspace setup ---
 setup_workspace "link-fixer"
 TMPDIR="$PROGRAM_TMPDIR"
@@ -79,7 +84,7 @@ for repo_dir in "$REPOS_DIR"/*/ "$REPOS_DIR"/.github/; do
   esac
   SEEN_CANON="$SEEN_CANON $canon"
 
-  full_repo="rossoctl/$canon"
+  full_repo="$ORG/$canon"
 
   issues_json=$(gh issue list --repo "$full_repo" \
     --search "Broken link in:title" \
@@ -383,8 +388,10 @@ while IFS= read -r item; do
 
   echo "    FIX: $target_path -> $new_path"
 
-  # Determine which repo contains the source file that needs editing
-  source_repo_name="${repo#"$ORG/"}"
+  # Determine which repo contains the source file that needs editing.
+  # $repo is always "owner/name"; strip any owner so the bare repo name is
+  # correct regardless of which org owns it (do not couple to $ORG).
+  source_repo_name="${repo##*/}"
 
   jq -nc \
     --arg number "$number" \

From fd6319f0d10a4ada9f1edc2af62a9645d708ca13 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Mon, 3 Aug 2026 18:06:09 -0400
Subject: [PATCH 05/15] refactor: Wire link-health/dashboard writes to
 MAIN_REPO

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/automation-health-dashboard.sh | 63 +++++++++++++++-----------
 scripts/link-health-scanner.sh         | 36 +++++++++++----
 2 files changed, 62 insertions(+), 37 deletions(-)

diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index 1f89f7e..0d80353 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -13,23 +13,26 @@ set -euo pipefail
 # =============================================================================
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/program-lib.sh"
 
 # --- CLI args ---
 DRY_RUN=true
-ORG="kagenti"
 VERBOSE=false
 SHOW_HELP=false
-FORK_OWNER="${FORK_OWNER:-clawgenti}"
-KAGENTI_DIR="${KAGENTI_DIR:-}"
+MAIN_REPO_DIR="${MAIN_REPO_DIR:-${KAGENTI_DIR:-}}"
 
 while [[ $# -gt 0 ]]; do
   case $1 in
     --dry-run) DRY_RUN=true; shift ;;
     --live) DRY_RUN=false; shift ;;
     --reports-dir) REPORTS_DIR="$2"; shift 2 ;;
-    --kagenti-dir) KAGENTI_DIR="$2"; shift 2 ;;
-    --org) ORG="$2"; shift 2 ;;
-    --fork-owner) FORK_OWNER="$2"; shift 2 ;;
+    --main-repo-dir) MAIN_REPO_DIR="$2"; shift 2 ;;
+    --kagenti-dir)   # deprecated alias, remove after one release
+      echo "WARN: --kagenti-dir is deprecated; use --main-repo-dir" >&2
+      MAIN_REPO_DIR="$2"; shift 2 ;;
+    --org) ORG_FLAG="$2"; shift 2 ;;
+    --fork-owner) FORK_OWNER_FLAG="$2"; shift 2 ;;
     --verbose) VERBOSE=true; shift ;;
     --help|-h) SHOW_HELP=true; shift ;;
     *) echo "Unknown option: $1"; exit 1 ;;
@@ -49,21 +52,27 @@ Usage:
 Options:
   --dry-run           Generate and preview dashboard (default)
   --live              Commit and push to fork, create/update PR
-  --reports-dir DIR   Base reports directory (default: $REPORTS_DIR or ./reports)
-  --kagenti-dir DIR   Path to kagenti repo clone (default: $KAGENTI_DIR)
-  --org NAME          GitHub org (default: kagenti)
-  --fork-owner NAME   Fork owner for PR workflow (default: clawgenti)
-  --verbose           Print diagnostic output
-  --help, -h          Show this help
+  --reports-dir DIR    Base reports directory (default: $REPORTS_DIR or ./reports)
+  --main-repo-dir DIR  Path to the org main repo clone (default: $MAIN_REPO_DIR)
+  --kagenti-dir DIR    Deprecated alias for --main-repo-dir
+  --org NAME           GitHub org (default: from profile, config/org.env)
+  --fork-owner NAME    Fork owner for PR workflow (default: from profile)
+  --verbose            Print diagnostic output
+  --help, -h           Show this help
 
 Environment:
-  REPORTS_DIR   Base directory containing link-scan/ and dep-bump/ subdirs
-  KAGENTI_DIR   Path to the org's main repo clone (for live mode git operations)
-  FORK_OWNER    Fork owner for cross-fork PRs
+  REPORTS_DIR    Base directory containing link-scan/ and dep-bump/ subdirs
+  MAIN_REPO_DIR  Path to the org's main repo clone (live mode git ops)
+  FORK_OWNER     Fork owner for cross-fork PRs
 HELP
   exit 0
 fi
 
+# Resolve org identity (--flag > env > profile > default). Sets ORG, FORK_OWNER,
+# MAIN_REPO, REPOS_DIR, REMAP. The dashboard-report PR targets $MAIN_REPO via
+# $FORK_OWNER.
+load_org_profile
+
 # --- Validate inputs ---
 if [ -z "${REPORTS_DIR:-}" ]; then
   if [ -d "./reports" ]; then
@@ -435,26 +444,26 @@ if [ "$DRY_RUN" = true ]; then
   echo "---"
   echo "[DRY RUN] Would push docs/automation-health.md to fork and create/update PR"
 else
-  if [ -z "$KAGENTI_DIR" ]; then
-    echo "ERROR: KAGENTI_DIR is not set (required for live mode)."
-    echo "Export it to the path of the kagenti/kagenti repo clone:"
-    echo "  export KAGENTI_DIR=~/kagenti/kagenti"
+  if [ -z "$MAIN_REPO_DIR" ]; then
+    echo "ERROR: MAIN_REPO_DIR is not set (required for live mode)."
+    echo "Export it to the path of the $MAIN_REPO repo clone:"
+    echo "  export MAIN_REPO_DIR=$REPOS_DIR/${MAIN_REPO##*/}"
     exit 1
   fi
 
-  if [ ! -d "$KAGENTI_DIR/.git" ]; then
-    echo "ERROR: $KAGENTI_DIR does not appear to be a git repository."
+  if [ ! -d "$MAIN_REPO_DIR/.git" ]; then
+    echo "ERROR: $MAIN_REPO_DIR does not appear to be a git repository."
     exit 1
   fi
 
   FORK_REMOTE="$FORK_OWNER"
   DASHBOARD_BRANCH="automation/health-dashboard"
 
-  cd "$KAGENTI_DIR"
+  cd "$MAIN_REPO_DIR"
 
   # Ensure fork remote exists
   if ! git remote get-url "$FORK_REMOTE" &>/dev/null; then
-    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/$ORG.git"
+    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${MAIN_REPO##*/}.git"
   fi
 
   # Fetch fork's branch if it exists, otherwise create from main
@@ -473,7 +482,7 @@ else
   git push "$FORK_REMOTE" "$DASHBOARD_BRANCH" 2>/dev/null || echo "WARN: Failed to push dashboard to fork"
 
   # Create or update standing cross-fork PR
-  existing_pr=$(gh api "repos/$ORG/$ORG/pulls?head=$FORK_OWNER:$DASHBOARD_BRANCH&state=open" \
+  existing_pr=$(gh api "repos/$MAIN_REPO/pulls?head=$FORK_OWNER:$DASHBOARD_BRANCH&state=open" \
     --jq '.[0].number' 2>/dev/null || echo "")
 
   pr_body="## Summary
@@ -489,15 +498,15 @@ Auto-updated by Kagenti Automation Health Dashboard. This PR is continuously upd
 
 ## Related issue(s)
 
-- kagenti/kagenti#1260"
+- $MAIN_REPO#1260"
 
   if [ -z "$existing_pr" ] || [ "$existing_pr" = "null" ]; then
-    gh pr create --repo "$ORG/$ORG" \
+    gh pr create --repo "$MAIN_REPO" \
       --head "$FORK_OWNER:$DASHBOARD_BRANCH" --base main \
       --title "docs: Automation health dashboard (auto-updated)" \
       --body "$pr_body" 2>/dev/null || echo "WARN: Failed to create dashboard PR"
   else
-    gh pr edit "$existing_pr" --repo "$ORG/$ORG" --body "$pr_body" 2>/dev/null || true
+    gh pr edit "$existing_pr" --repo "$MAIN_REPO" --body "$pr_body" 2>/dev/null || true
   fi
 
   echo "Dashboard committed and pushed"
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 886687e..61b1f8b 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -25,16 +25,32 @@ while [[ $# -gt 0 ]]; do
   case $1 in
     --dry-run) DRY_RUN=true; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
+    --org) ORG_FLAG="$2"; shift 2 ;;
+    --fork-owner) FORK_OWNER_FLAG="$2"; shift 2 ;;
+    --repos-dir) REPOS_DIR_FLAG="$2"; shift 2 ;;
     *) echo "Unknown option: $1"; exit 1 ;;
   esac
 done
 
+# Resolve org identity (--flag > env > profile > default). Sets ORG, FORK_OWNER,
+# MAIN_REPO, REPOS_DIR, REMAP. The dashboard-report PR targets $MAIN_REPO via
+# $FORK_OWNER; issue reads use canonical $ORG/<name>.
+load_org_profile
+
 # --- Configuration ---
-REPOS_DIR="${REPOS_DIR:-$HOME/kagenti}"
 REPORTS_DIR="${REPORTS_DIR:-$HOME/workspaces/clawgenti/reports/link-scan}"
-KAGENTI_REPO="$REPOS_DIR/kagenti"
+
+# Main repo clone dir: canonical name of the org's main repo under REPOS_DIR.
+MAIN_REPO_NAME="${MAIN_REPO##*/}"
+MAIN_REPO_DIR="$REPOS_DIR/$MAIN_REPO_NAME"
+# On a host whose clone dir is still the pre-rename name, fall back and warn
+# (REMAP does not rewrite REPOS_DIR paths; see #37).
+if [ ! -d "$MAIN_REPO_DIR/.git" ] && [ -d "$REPOS_DIR/kagenti/.git" ]; then
+  echo "WARN: $MAIN_REPO_DIR missing; using transitional $REPOS_DIR/kagenti (see #37)" >&2
+  MAIN_REPO_DIR="$REPOS_DIR/kagenti"
+fi
+
 FORK_REMOTE="clawgenti-kagenti-fork"
-FORK_OWNER="clawgenti"
 SCAN_DATE=$(date -u +"%Y-%m-%d")
 SCAN_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 MAX_HISTORY_ROWS=500
@@ -429,11 +445,11 @@ if [ "$DRY_RUN" = true ]; then
   echo "[DRY RUN] Dashboard preview:"
   cat "$TMPDIR/link-health.md"
 else
-  cd "$KAGENTI_REPO"
+  cd "$MAIN_REPO_DIR"
 
   # Ensure fork remote exists
   if ! git remote get-url "$FORK_REMOTE" &>/dev/null; then
-    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/kagenti.git"
+    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${MAIN_REPO_NAME}.git"
   fi
 
   # Fetch fork's branch if it exists, otherwise create from main
@@ -452,7 +468,7 @@ else
   git push "$FORK_REMOTE" link-health/reports 2>/dev/null || echo "WARN: Failed to push dashboard to fork"
 
   # Create or update standing cross-fork PR
-  existing_pr=$(gh api "repos/kagenti/kagenti/pulls?head=$FORK_OWNER:link-health/reports&state=open" \
+  existing_pr=$(gh api "repos/$MAIN_REPO/pulls?head=$FORK_OWNER:link-health/reports&state=open" \
     --jq '.[0].number' 2>/dev/null || echo "")
 
   pr_body="## Summary
@@ -469,15 +485,15 @@ Auto-updated by Kagenti Link Health Scanner. This PR is continuously updated wit
 
 ## Related issue(s)
 
-- kagenti/kagenti#1178"
+- $MAIN_REPO#1178"
 
   if [ -z "$existing_pr" ] || [ "$existing_pr" = "null" ]; then
-    gh pr create --repo kagenti/kagenti \
+    gh pr create --repo "$MAIN_REPO" \
       --head "$FORK_OWNER:link-health/reports" --base main \
       --title "docs: Link health report (auto-updated)" \
       --body "$pr_body" 2>/dev/null || echo "WARN: Failed to create dashboard PR"
   else
-    gh pr edit "$existing_pr" --repo kagenti/kagenti --body "$pr_body" 2>/dev/null || true
+    gh pr edit "$existing_pr" --repo "$MAIN_REPO" --body "$pr_body" 2>/dev/null || true
   fi
 fi
 
@@ -488,7 +504,7 @@ if [ "$NEW_LINKS" -gt "$ESCALATION_THRESHOLD" ]; then
   echo ""
   echo "ALERT: Link health scan found $NEW_LINKS new broken links (threshold: $ESCALATION_THRESHOLD)."
   echo "This may indicate a bulk documentation change or a widespread external service outage."
-  echo "Review issues at https://github.com/kagenti/kagenti/issues?q=label:broken-link"
+  echo "Review issues at https://github.com/$MAIN_REPO/issues?q=label:broken-link"
 fi
 
 # --- Summary ---

From 2b88df9c2fcfa8781af29bafc634cee574a1e53e Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Tue, 4 Aug 2026 08:40:19 -0400
Subject: [PATCH 06/15] fix: Redirect report PRs to automation docs/reports

The org main repo's docs/ folder now sources the docs site (rossoctl.dev),
which overwrites the machine-generated report files. Temporarily redirect the
standing link-health and automation-health report PRs to docs/reports/ in the
automation repo. Tracking: rossoctl/automation#44 (ref rossoctl/rossoctl#2315).

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/automation-health-dashboard.sh | 45 ++++++++++++++++----------
 scripts/link-health-scanner.sh         | 38 +++++++++++-----------
 2 files changed, 48 insertions(+), 35 deletions(-)

diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index 0d80353..f7cadc3 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -69,10 +69,21 @@ HELP
 fi
 
 # Resolve org identity (--flag > env > profile > default). Sets ORG, FORK_OWNER,
-# MAIN_REPO, REPOS_DIR, REMAP. The dashboard-report PR targets $MAIN_REPO via
-# $FORK_OWNER.
+# MAIN_REPO, REPOS_DIR, REMAP.
 load_org_profile
 
+# Report-PR destination. TEMPORARY: the org main repo's docs/ folder now sources
+# the docs site (rossoctl.dev), which overwrites machine-generated reports, so
+# the standing dashboard PR is redirected to docs/reports/ in the automation
+# repo. Revert to $MAIN_REPO once a permanent home is chosen
+# (rossoctl/automation#44; see rossoctl/rossoctl#2315).
+REPORT_TARGET_REPO="$ORG/automation"
+REPORT_TARGET_NAME="${REPORT_TARGET_REPO##*/}"
+REPORT_TARGET_PATH="docs/reports/automation-health.md"
+# Clone dir for the report target: honor an explicit --main-repo-dir/MAIN_REPO_DIR
+# override, else derive from REPOS_DIR.
+REPORT_TARGET_DIR="${MAIN_REPO_DIR:-$REPOS_DIR/$REPORT_TARGET_NAME}"
+
 # --- Validate inputs ---
 if [ -z "${REPORTS_DIR:-}" ]; then
   if [ -d "./reports" ]; then
@@ -442,28 +453,28 @@ if [ "$DRY_RUN" = true ]; then
   echo "---"
   cat "$TMPDIR/automation-health.md"
   echo "---"
-  echo "[DRY RUN] Would push docs/automation-health.md to fork and create/update PR"
+  echo "[DRY RUN] Would push $REPORT_TARGET_PATH to fork and create/update PR against $REPORT_TARGET_REPO"
 else
-  if [ -z "$MAIN_REPO_DIR" ]; then
-    echo "ERROR: MAIN_REPO_DIR is not set (required for live mode)."
-    echo "Export it to the path of the $MAIN_REPO repo clone:"
-    echo "  export MAIN_REPO_DIR=$REPOS_DIR/${MAIN_REPO##*/}"
+  if [ -z "$REPORT_TARGET_DIR" ]; then
+    echo "ERROR: report target clone dir is not set (required for live mode)."
+    echo "Export MAIN_REPO_DIR or set REPOS_DIR so $REPORT_TARGET_REPO can be found:"
+    echo "  export MAIN_REPO_DIR=$REPOS_DIR/$REPORT_TARGET_NAME"
     exit 1
   fi
 
-  if [ ! -d "$MAIN_REPO_DIR/.git" ]; then
-    echo "ERROR: $MAIN_REPO_DIR does not appear to be a git repository."
+  if [ ! -d "$REPORT_TARGET_DIR/.git" ]; then
+    echo "ERROR: $REPORT_TARGET_DIR does not appear to be a git repository."
     exit 1
   fi
 
   FORK_REMOTE="$FORK_OWNER"
   DASHBOARD_BRANCH="automation/health-dashboard"
 
-  cd "$MAIN_REPO_DIR"
+  cd "$REPORT_TARGET_DIR"
 
   # Ensure fork remote exists
   if ! git remote get-url "$FORK_REMOTE" &>/dev/null; then
-    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${MAIN_REPO##*/}.git"
+    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${REPORT_TARGET_NAME}.git"
   fi
 
   # Fetch fork's branch if it exists, otherwise create from main
@@ -475,14 +486,14 @@ else
       || git checkout -B "$DASHBOARD_BRANCH"
   fi
 
-  mkdir -p docs
-  cp "$TMPDIR/automation-health.md" docs/automation-health.md
-  git add docs/automation-health.md
+  mkdir -p "$(dirname "$REPORT_TARGET_PATH")"
+  cp "$TMPDIR/automation-health.md" "$REPORT_TARGET_PATH"
+  git add "$REPORT_TARGET_PATH"
   git commit -s -m "docs: Update automation health dashboard ($SCAN_TIME_ET)" 2>/dev/null || echo "No changes to commit"
   git push "$FORK_REMOTE" "$DASHBOARD_BRANCH" 2>/dev/null || echo "WARN: Failed to push dashboard to fork"
 
   # Create or update standing cross-fork PR
-  existing_pr=$(gh api "repos/$MAIN_REPO/pulls?head=$FORK_OWNER:$DASHBOARD_BRANCH&state=open" \
+  existing_pr=$(gh api "repos/$REPORT_TARGET_REPO/pulls?head=$FORK_OWNER:$DASHBOARD_BRANCH&state=open" \
     --jq '.[0].number' 2>/dev/null || echo "")
 
   pr_body="## Summary
@@ -501,12 +512,12 @@ Auto-updated by Kagenti Automation Health Dashboard. This PR is continuously upd
 - $MAIN_REPO#1260"
 
   if [ -z "$existing_pr" ] || [ "$existing_pr" = "null" ]; then
-    gh pr create --repo "$MAIN_REPO" \
+    gh pr create --repo "$REPORT_TARGET_REPO" \
       --head "$FORK_OWNER:$DASHBOARD_BRANCH" --base main \
       --title "docs: Automation health dashboard (auto-updated)" \
       --body "$pr_body" 2>/dev/null || echo "WARN: Failed to create dashboard PR"
   else
-    gh pr edit "$existing_pr" --repo "$MAIN_REPO" --body "$pr_body" 2>/dev/null || true
+    gh pr edit "$existing_pr" --repo "$REPORT_TARGET_REPO" --body "$pr_body" 2>/dev/null || true
   fi
 
   echo "Dashboard committed and pushed"
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 61b1f8b..74321fd 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -40,15 +40,17 @@ load_org_profile
 # --- Configuration ---
 REPORTS_DIR="${REPORTS_DIR:-$HOME/workspaces/clawgenti/reports/link-scan}"
 
-# Main repo clone dir: canonical name of the org's main repo under REPOS_DIR.
-MAIN_REPO_NAME="${MAIN_REPO##*/}"
-MAIN_REPO_DIR="$REPOS_DIR/$MAIN_REPO_NAME"
-# On a host whose clone dir is still the pre-rename name, fall back and warn
-# (REMAP does not rewrite REPOS_DIR paths; see #37).
-if [ ! -d "$MAIN_REPO_DIR/.git" ] && [ -d "$REPOS_DIR/kagenti/.git" ]; then
-  echo "WARN: $MAIN_REPO_DIR missing; using transitional $REPOS_DIR/kagenti (see #37)" >&2
-  MAIN_REPO_DIR="$REPOS_DIR/kagenti"
-fi
+# Report-PR destination. TEMPORARY: the org main repo's docs/ folder now
+# sources the docs site (rossoctl.dev), which overwrites machine-generated
+# reports, so the standing report PR is redirected to docs/reports/ in the
+# automation repo. Revert to $MAIN_REPO once a permanent home is chosen
+# (rossoctl/automation#44; see rossoctl/rossoctl#2315).
+REPORT_TARGET_REPO="$ORG/automation"
+REPORT_TARGET_NAME="${REPORT_TARGET_REPO##*/}"
+REPORT_TARGET_PATH="docs/reports/link-health.md"
+
+# Clone dir for the report target under REPOS_DIR.
+REPORT_TARGET_DIR="$REPOS_DIR/$REPORT_TARGET_NAME"
 
 FORK_REMOTE="clawgenti-kagenti-fork"
 SCAN_DATE=$(date -u +"%Y-%m-%d")
@@ -441,15 +443,15 @@ DASHBOARD_EOF
 
 # Commit and push dashboard
 if [ "$DRY_RUN" = true ]; then
-  echo "[DRY RUN] Would push docs/link-health.md to fork and create/update cross-fork PR"
+  echo "[DRY RUN] Would push $REPORT_TARGET_PATH to fork and create/update cross-fork PR against $REPORT_TARGET_REPO"
   echo "[DRY RUN] Dashboard preview:"
   cat "$TMPDIR/link-health.md"
 else
-  cd "$MAIN_REPO_DIR"
+  cd "$REPORT_TARGET_DIR"
 
   # Ensure fork remote exists
   if ! git remote get-url "$FORK_REMOTE" &>/dev/null; then
-    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${MAIN_REPO_NAME}.git"
+    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${REPORT_TARGET_NAME}.git"
   fi
 
   # Fetch fork's branch if it exists, otherwise create from main
@@ -461,14 +463,14 @@ else
       || git checkout -B link-health/reports
   fi
 
-  mkdir -p docs
-  cp "$TMPDIR/link-health.md" docs/link-health.md
-  git add docs/link-health.md
+  mkdir -p "$(dirname "$REPORT_TARGET_PATH")"
+  cp "$TMPDIR/link-health.md" "$REPORT_TARGET_PATH"
+  git add "$REPORT_TARGET_PATH"
   git commit -s -m "docs: Update link health dashboard ($SCAN_ID)" 2>/dev/null || echo "No changes to commit"
   git push "$FORK_REMOTE" link-health/reports 2>/dev/null || echo "WARN: Failed to push dashboard to fork"
 
   # Create or update standing cross-fork PR
-  existing_pr=$(gh api "repos/$MAIN_REPO/pulls?head=$FORK_OWNER:link-health/reports&state=open" \
+  existing_pr=$(gh api "repos/$REPORT_TARGET_REPO/pulls?head=$FORK_OWNER:link-health/reports&state=open" \
     --jq '.[0].number' 2>/dev/null || echo "")
 
   pr_body="## Summary
@@ -488,12 +490,12 @@ Auto-updated by Kagenti Link Health Scanner. This PR is continuously updated wit
 - $MAIN_REPO#1178"
 
   if [ -z "$existing_pr" ] || [ "$existing_pr" = "null" ]; then
-    gh pr create --repo "$MAIN_REPO" \
+    gh pr create --repo "$REPORT_TARGET_REPO" \
       --head "$FORK_OWNER:link-health/reports" --base main \
       --title "docs: Link health report (auto-updated)" \
       --body "$pr_body" 2>/dev/null || echo "WARN: Failed to create dashboard PR"
   else
-    gh pr edit "$existing_pr" --repo "$MAIN_REPO" --body "$pr_body" 2>/dev/null || true
+    gh pr edit "$existing_pr" --repo "$REPORT_TARGET_REPO" --body "$pr_body" 2>/dev/null || true
   fi
 fi
 

From 136542faa503e25660a13442a38fd903423e0248 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Tue, 4 Aug 2026 08:46:56 -0400
Subject: [PATCH 07/15] docs: Clarify report-target vs main-repo in comments

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/automation-health-dashboard.sh | 6 ++++--
 scripts/link-health-scanner.sh         | 5 +++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index f7cadc3..4a3f848 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -53,7 +53,8 @@ Options:
   --dry-run           Generate and preview dashboard (default)
   --live              Commit and push to fork, create/update PR
   --reports-dir DIR    Base reports directory (default: $REPORTS_DIR or ./reports)
-  --main-repo-dir DIR  Path to the org main repo clone (default: $MAIN_REPO_DIR)
+  --main-repo-dir DIR  Path to the report-target repo clone, overriding the
+                       REPOS_DIR-derived default (default: $MAIN_REPO_DIR)
   --kagenti-dir DIR    Deprecated alias for --main-repo-dir
   --org NAME           GitHub org (default: from profile, config/org.env)
   --fork-owner NAME    Fork owner for PR workflow (default: from profile)
@@ -62,7 +63,8 @@ Options:
 
 Environment:
   REPORTS_DIR    Base directory containing link-scan/ and dep-bump/ subdirs
-  MAIN_REPO_DIR  Path to the org's main repo clone (live mode git ops)
+  MAIN_REPO_DIR  Path to the report-target repo clone (live mode git ops);
+                 overrides the REPOS_DIR-derived default
   FORK_OWNER     Fork owner for cross-fork PRs
 HELP
   exit 0
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 74321fd..6a4bb03 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -33,8 +33,9 @@ while [[ $# -gt 0 ]]; do
 done
 
 # Resolve org identity (--flag > env > profile > default). Sets ORG, FORK_OWNER,
-# MAIN_REPO, REPOS_DIR, REMAP. The dashboard-report PR targets $MAIN_REPO via
-# $FORK_OWNER; issue reads use canonical $ORG/<name>.
+# MAIN_REPO, REPOS_DIR, REMAP. Issue reads use canonical $ORG/<name>; $MAIN_REPO
+# backs the related-issue refs and the escalation URL. The report PR itself
+# targets $REPORT_TARGET_REPO (see the report-destination block below).
 load_org_profile
 
 # --- Configuration ---

From b1bde17e7bd2f3a8fb7b8c7c3cb32c049be910cc Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Tue, 4 Aug 2026 09:27:14 -0400
Subject: [PATCH 08/15] feat: Add --profile/--org flags across programs

Wire the documented --profile <name> selector (and --org for the two
pr-review programs that lacked it) into each program's arg loop so the
profile can be chosen per invocation, matching README and the loader's
PROFILE_FLAG/ORG_FLAG precedence inputs.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/automation-health-dashboard.sh | 2 ++
 scripts/dep-bump-fixer.sh              | 2 ++
 scripts/dep-bump-scanner.sh            | 2 ++
 scripts/link-health-fixer.sh           | 1 +
 scripts/link-health-scanner.sh         | 1 +
 scripts/pr-review-impact.sh            | 4 ++++
 scripts/pr-review-scanner.sh           | 4 ++++
 7 files changed, 16 insertions(+)

diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index 4a3f848..04fdfa4 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -31,6 +31,7 @@ while [[ $# -gt 0 ]]; do
     --kagenti-dir)   # deprecated alias, remove after one release
       echo "WARN: --kagenti-dir is deprecated; use --main-repo-dir" >&2
       MAIN_REPO_DIR="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --org) ORG_FLAG="$2"; shift 2 ;;
     --fork-owner) FORK_OWNER_FLAG="$2"; shift 2 ;;
     --verbose) VERBOSE=true; shift ;;
@@ -56,6 +57,7 @@ Options:
   --main-repo-dir DIR  Path to the report-target repo clone, overriding the
                        REPOS_DIR-derived default (default: $MAIN_REPO_DIR)
   --kagenti-dir DIR    Deprecated alias for --main-repo-dir
+  --profile NAME       Org profile to load (config/org.<name>.env; default org.env)
   --org NAME           GitHub org (default: from profile, config/org.env)
   --fork-owner NAME    Fork owner for PR workflow (default: from profile)
   --verbose            Print diagnostic output
diff --git a/scripts/dep-bump-fixer.sh b/scripts/dep-bump-fixer.sh
index f0e7170..4e2f0f3 100644
--- a/scripts/dep-bump-fixer.sh
+++ b/scripts/dep-bump-fixer.sh
@@ -28,6 +28,7 @@ while [[ $# -gt 0 ]]; do
     --dry-run) DRY_RUN=true; shift ;;
     --live) DRY_RUN=false; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --org) ORG_FLAG="$2"; shift 2 ;;
     --verbose) VERBOSE=true; shift ;;
     --help|-h) SHOW_HELP=true; shift ;;
@@ -46,6 +47,7 @@ OPTIONS:
   --dry-run         Analyze and preview comments only (default)
   --live            Post comments on PRs and issues
   --issue-limit N   Process at most N issues (default: 5)
+  --profile NAME    Org profile to load (config/org.<name>.env; default org.env)
   --org NAME        GitHub org (default: from profile, config/org.env)
   --verbose         Print additional diagnostic output
   --help, -h        Show this help
diff --git a/scripts/dep-bump-scanner.sh b/scripts/dep-bump-scanner.sh
index b659c23..f10bc51 100644
--- a/scripts/dep-bump-scanner.sh
+++ b/scripts/dep-bump-scanner.sh
@@ -27,6 +27,7 @@ while [[ $# -gt 0 ]]; do
   case $1 in
     --dry-run) DRY_RUN=true; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --org) ORG_FLAG="$2"; shift 2 ;;
     --help|-h) SHOW_HELP=true; shift ;;
     *) echo "Unknown option: $1"; exit 1 ;;
@@ -43,6 +44,7 @@ USAGE:
 OPTIONS:
   --dry-run         Scan and report only; do not create/close issues
   --issue-limit N   Create at most N issues per run (0 = unlimited)
+  --profile NAME    Org profile to load (config/org.<name>.env; default org.env)
   --org NAME        GitHub org to scan (default: from profile, config/org.env)
   --help, -h        Show this help
 
diff --git a/scripts/link-health-fixer.sh b/scripts/link-health-fixer.sh
index 1132357..9711d7a 100755
--- a/scripts/link-health-fixer.sh
+++ b/scripts/link-health-fixer.sh
@@ -32,6 +32,7 @@ while [[ $# -gt 0 ]]; do
     --live) DRY_RUN=false; shift ;;
     --dry-run) DRY_RUN=true; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --org) ORG_FLAG="$2"; shift 2 ;;
     --fork-owner) FORK_OWNER_FLAG="$2"; shift 2 ;;
     --repos-dir) REPOS_DIR_FLAG="$2"; shift 2 ;;
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 6a4bb03..18e30c0 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -25,6 +25,7 @@ while [[ $# -gt 0 ]]; do
   case $1 in
     --dry-run) DRY_RUN=true; shift ;;
     --issue-limit) ISSUE_LIMIT="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --org) ORG_FLAG="$2"; shift 2 ;;
     --fork-owner) FORK_OWNER_FLAG="$2"; shift 2 ;;
     --repos-dir) REPOS_DIR_FLAG="$2"; shift 2 ;;
diff --git a/scripts/pr-review-impact.sh b/scripts/pr-review-impact.sh
index 88a1a4b..205885c 100755
--- a/scripts/pr-review-impact.sh
+++ b/scripts/pr-review-impact.sh
@@ -51,6 +51,8 @@ while [[ $# -gt 0 ]]; do
     --verbose) VERBOSE=true; shift ;;
     --dry-run) DRY_RUN=true; shift ;;
     --reports-dir) REPORTS_DIR="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
+    --org) ORG_FLAG="$2"; shift 2 ;;
     --help|-h) SHOW_HELP=true; shift ;;
     *) echo "Unknown option: $1" >&2; exit 1 ;;
   esac
@@ -74,6 +76,8 @@ Options:
   --dry-run           Compute and print impact.json to stdout; do not write
   --reports-dir DIR   Where to write impact.json (default: ./reports/pr-review,
                       or $REPORTS_DIR if set in the environment)
+  --profile NAME      Org profile to load (config/org.<name>.env; default org.env)
+  --org NAME          GitHub org (default: from profile, config/org.env)
   --help, -h          Show this help
 
 NOTES:
diff --git a/scripts/pr-review-scanner.sh b/scripts/pr-review-scanner.sh
index 46400db..5372634 100755
--- a/scripts/pr-review-scanner.sh
+++ b/scripts/pr-review-scanner.sh
@@ -21,6 +21,8 @@ while [[ $# -gt 0 ]]; do
     --verbose) VERBOSE=true; shift ;;
     --dry-run) DRY_RUN=true; shift ;;
     --reports-dir) REPORTS_DIR="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
+    --org) ORG_FLAG="$2"; shift 2 ;;
     --help|-h) SHOW_HELP=true; shift ;;
     *) echo "Unknown option: $1" >&2; exit 1 ;;
   esac
@@ -39,6 +41,8 @@ OPTIONS:
   --verbose           Print diagnostic output to stderr
   --dry-run           Query GitHub but do not write reports (stdout output still produced)
   --reports-dir DIR   Where to write reports (default: $REPORTS_DIR or ./reports/pr-review)
+  --profile NAME      Org profile to load (config/org.<name>.env; default org.env)
+  --org NAME          GitHub org (default: from profile, config/org.env)
   --help, -h          Show this help
 
 OUTPUT:

From 887c3d9b30a2ca8f0df109e0e51802a1599923ce Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Tue, 4 Aug 2026 09:33:18 -0400
Subject: [PATCH 09/15] test: Add org portability smoke test and docs

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 README.md                        | 27 +++++++++++++++++++++---
 docs/running-without-openclaw.md | 35 ++++++++++++++++++++++++++------
 tests/fixtures/org.testorg.env   |  3 +++
 tests/test-org-profile.sh        | 18 +++++++++++++++-
 4 files changed, 73 insertions(+), 10 deletions(-)
 create mode 100644 tests/fixtures/org.testorg.env

diff --git a/README.md b/README.md
index 00a01ae..d1df87c 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,28 @@ reports/           (gitignored) Runtime data stays on remote host only
 | Dependency Bump | `scripts/dep-bump-scanner.sh` | `scripts/dep-bump-fixer.sh` | Tracks and triages Dependabot PRs across repos (comments, closes stale, audits coverage) |
 | Health Dashboard | `scripts/automation-health-dashboard.sh` | — | Aggregates program run health into a dashboard |
 
-Shared helpers live in `scripts/program-lib.sh`. Repo coverage comes from the `config/core-repos.txt` allowlist via `get_core_repos()` (one `owner/name` per line; `#` comments and blank lines allowed) -- edit that file to change which repos are scanned.
+Shared helpers live in `scripts/program-lib.sh`. Repo coverage comes from the `config/core-repos.txt` allowlist via `get_core_repos()` (one **bare repo name** per line -- the owner is prepended from the active org; `#` comments and blank lines allowed) -- edit that file to change which repos are scanned.
+
+## Org profile
+
+Org identity (which GitHub org the programs target) lives in one committed profile file, `config/org.env`. It assigns only `PROFILE_`-prefixed keys:
+
+```bash
+PROFILE_ORG=rossoctl              # the org (required)
+PROFILE_FORK_OWNER=clawgenti      # fork account for cross-fork PRs
+PROFILE_MAIN_REPO=rossoctl/rossoctl
+PROFILE_REPOS_DIR=/home/claw/rossoctl
+PROFILE_REMAP="kagenti:rossoctl kagenti-extensions:cortex"  # transitional
+```
+
+Each program calls `load_org_profile()` (in `program-lib.sh`), which resolves the identity by precedence **`--flag` > env var > profile > built-in default**:
+
+- `--org NAME` / `ORG` -- the org (fails loud if it cannot be resolved).
+- `--fork-owner NAME` / `FORK_OWNER` -- fork account (default `clawgenti`).
+- `--repos-dir DIR` / `REPOS_DIR` -- local clone root (default `$HOME/$ORG`).
+- `--main-repo-dir DIR` / `MAIN_REPO_DIR` -- the main-repo clone for dashboard/report git ops.
+
+`PROFILE_REMAP` is profile-only (transitional; maps pre-rename clone-dir names to canonical names). To target a **different org**, copy `config/org.env` to `config/org.<name>.env`, edit the `PROFILE_*` values, and run any program with `--profile <name>` (or `ORG_PROFILE=<name>`). No per-script edits are needed.
 
 ## Deploy
 
@@ -35,10 +56,10 @@ scp scripts/<name>.sh kagenti-bot:~/workspaces/clawgenti/scripts/
 
 No gateway restart needed -- scripts are read from disk on each cron trigger.
 
-Scanners/fixers that use the allowlist also require `config/core-repos.txt` to be present on the host alongside the scripts:
+All programs resolve their org identity from `config/org.env`, and allowlist-driven scanners/fixers also read `config/core-repos.txt`. Both must be present on the host alongside the scripts:
 
 ```bash
-scp config/core-repos.txt kagenti-bot:~/workspaces/clawgenti/config/
+scp config/org.env config/core-repos.txt kagenti-bot:~/workspaces/clawgenti/config/
 ```
 
 ## Runtime
diff --git a/docs/running-without-openclaw.md b/docs/running-without-openclaw.md
index d354942..2e1ccd3 100644
--- a/docs/running-without-openclaw.md
+++ b/docs/running-without-openclaw.md
@@ -160,10 +160,33 @@ None of these are required for the scripts to work. They're convenience features
 
 ## Adapting for a Different Org
 
-To run against a different GitHub org:
+Org identity is no longer edited into each script. It lives in a committed
+profile file, `config/org.env`, resolved by `load_org_profile()` with
+precedence `--flag > env > profile > default`. To run against a different org:
 
-1. Clone that org's repos into `$REPOS_DIR`
-2. Edit `FORK_OWNER` in the fixer (or set it as an env var)
-3. Edit `ORG="rossoctl"` in the fixer to your org name
-4. Update DCO identity in the fixer (`GIT_AUTHOR_NAME` / `GIT_AUTHOR_EMAIL`)
-5. Run the scanner -- it will detect broken links and create issues in the target repos
+1. Copy the default profile and edit the `PROFILE_*` values for your org:
+
+   ```bash
+   cp config/org.env config/org.myorg.env
+   # edit config/org.myorg.env:
+   #   PROFILE_ORG=myorg
+   #   PROFILE_FORK_OWNER=myfork
+   #   PROFILE_MAIN_REPO=myorg/myorg
+   #   PROFILE_REPOS_DIR=$HOME/myorg
+   #   PROFILE_REMAP=""            # only for transitional dir renames
+   ```
+
+2. Clone that org's repos into the profile's `PROFILE_REPOS_DIR` (or override
+   at run time with `--repos-dir` / `$REPOS_DIR`).
+
+3. Run any program with `--profile myorg` (or `ORG_PROFILE=myorg`):
+
+   ```bash
+   bash scripts/link-health-scanner.sh --profile myorg --dry-run
+   ```
+
+   Individual facts can still be overridden per run without touching the
+   profile, e.g. `--org myorg --fork-owner myfork --repos-dir ~/myorg`.
+
+4. Update the DCO identity in the fixer (`GIT_AUTHOR_NAME` / `GIT_AUTHOR_EMAIL`)
+   if fix PRs should be attributed to a different maintainer.
diff --git a/tests/fixtures/org.testorg.env b/tests/fixtures/org.testorg.env
new file mode 100644
index 0000000..d02d735
--- /dev/null
+++ b/tests/fixtures/org.testorg.env
@@ -0,0 +1,3 @@
+PROFILE_ORG=testorg
+PROFILE_FORK_OWNER=testfork
+PROFILE_REMAP=""
diff --git a/tests/test-org-profile.sh b/tests/test-org-profile.sh
index 287f48b..eb9a336 100644
--- a/tests/test-org-profile.sh
+++ b/tests/test-org-profile.sh
@@ -82,4 +82,20 @@ if ( ORG_PROFILE_FILE="$TEST_TMPDIR/org.noorg.env"; load_org_profile ) >/dev/nul
   echo "FAIL should error when ORG cannot be resolved"; fail=1
 fi
 
-[ "$fail" -eq 0 ] && echo "PASS: load_org_profile (precedence, clobber-safety, defaults, fail-loud)" || exit 1
+# --- portability: a foreign-org profile yields testorg/* with no leak ---
+cat > "$TEST_TMPDIR/core.txt" <<'EOF'
+repo-one
+repo-two
+EOF
+got=$(
+  ORG_PROFILE_FILE="$SCRIPT_DIR/fixtures/org.testorg.env"
+  load_org_profile >/dev/null 2>&1
+  CORE_REPOS_FILE="$TEST_TMPDIR/core.txt" get_core_repos
+)
+want=$'testorg/repo-one\ntestorg/repo-two'
+[ "$got" = "$want" ] || { echo "FAIL portability: got [$got]"; fail=1; }
+case "$got" in
+  *rossoctl*|*kagenti*) echo "FAIL portability: org leak in [$got]"; fail=1 ;;
+esac
+
+[ "$fail" -eq 0 ] && echo "PASS: load_org_profile (precedence, clobber-safety, defaults, fail-loud, portability)" || exit 1

From 63a9e56ef96f1ac0b3e596faba52fa0ff793b951 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Tue, 4 Aug 2026 11:17:12 -0400
Subject: [PATCH 10/15] fix: Guard link-scanner report-target clone dir

The live report-push path did an unconditional cd into
$REPORT_TARGET_DIR ($REPOS_DIR/automation) under set -e, with no
existence guard and no MAIN_REPO_DIR override, so a missing clone
would abort hard mid-run. Mirror the dashboard's guard: honor a
MAIN_REPO_DIR override and validate the dir is a git repo before
cd, failing loud with actionable guidance in live mode. Dry-run is
unaffected (it never cd's).

Whole-branch review finding (Important) for PR B.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/link-health-scanner.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 18e30c0..0aa3f1f 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -51,8 +51,9 @@ REPORT_TARGET_REPO="$ORG/automation"
 REPORT_TARGET_NAME="${REPORT_TARGET_REPO##*/}"
 REPORT_TARGET_PATH="docs/reports/link-health.md"
 
-# Clone dir for the report target under REPOS_DIR.
-REPORT_TARGET_DIR="$REPOS_DIR/$REPORT_TARGET_NAME"
+# Clone dir for the report target: honor an explicit MAIN_REPO_DIR override,
+# else derive from REPOS_DIR.
+REPORT_TARGET_DIR="${MAIN_REPO_DIR:-$REPOS_DIR/$REPORT_TARGET_NAME}"
 
 FORK_REMOTE="clawgenti-kagenti-fork"
 SCAN_DATE=$(date -u +"%Y-%m-%d")
@@ -449,6 +450,18 @@ if [ "$DRY_RUN" = true ]; then
   echo "[DRY RUN] Dashboard preview:"
   cat "$TMPDIR/link-health.md"
 else
+  if [ -z "$REPORT_TARGET_DIR" ]; then
+    echo "ERROR: report target clone dir is not set (required for live mode)."
+    echo "Export MAIN_REPO_DIR or set REPOS_DIR so $REPORT_TARGET_REPO can be found:"
+    echo "  export MAIN_REPO_DIR=$REPOS_DIR/$REPORT_TARGET_NAME"
+    exit 1
+  fi
+
+  if [ ! -d "$REPORT_TARGET_DIR/.git" ]; then
+    echo "ERROR: $REPORT_TARGET_DIR does not appear to be a git repository."
+    exit 1
+  fi
+
   cd "$REPORT_TARGET_DIR"
 
   # Ensure fork remote exists

From 4c207da14e6289b171e0db572d348ccbec71b13d Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Tue, 4 Aug 2026 12:41:35 -0400
Subject: [PATCH 11/15] style: Drop stale org suffix from report-writer banners
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The link-scanner and dashboard header comments still read
'— kagenti org'. Both scripts are org-neutral now (org resolved
via profile), so drop the suffix rather than hardcode a new org.
Cosmetic; whole-branch review Minor finding.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/automation-health-dashboard.sh | 2 +-
 scripts/link-health-scanner.sh         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index 04fdfa4..b61c869 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # =============================================================================
-# Automation Health Dashboard Generator — kagenti org
+# Automation Health Dashboard Generator
 # Combines link-health and dep-bump program metrics into a single executive-
 # facing markdown dashboard. Pushes to a standing fork-based PR.
 #
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 0aa3f1f..f1d8f65 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # =============================================================================
-# Link Health Scanner — kagenti org
+# Link Health Scanner
 # Scans all repos for broken links, creates/closes GitHub issues, writes reports.
 #
 # Usage:

From a8d8f12ca77fe32a5d361a2ad2e8c346da2edc31 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Tue, 4 Aug 2026 16:16:45 -0400
Subject: [PATCH 12/15] fix: Land reports under automation-health/ (permanent
 home)

Per rossoctl/automation#44: the main repo docs/ feeds rossoctl.dev
and cannot host machine reports. Both standing report PRs (link-
health scanner + automation-health dashboard) now write a single
perpetual file under automation-health/ in the automation repo,
overwritten in place each run. Trends come from replaying git
commit history, so we store state (not dated snapshots) and avoid
the files-vs-diffs-on-Git anti-pattern.

- link-health-scanner:  automation-health/link-health.md
- dashboard:            automation-health/automation-health.md
- add automation-health/README.md documenting the convention

Supersedes the earlier docs/reports/ redirect; the dashboard PR
(previously accepted in the main repo) is redirected too for
consistency. Was TEMPORARY, now the settled home.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 automation-health/README.md            | 20 ++++++++++++++++++++
 scripts/automation-health-dashboard.sh | 13 +++++++------
 scripts/link-health-scanner.sh         | 13 +++++++------
 3 files changed, 34 insertions(+), 12 deletions(-)
 create mode 100644 automation-health/README.md

diff --git a/automation-health/README.md b/automation-health/README.md
new file mode 100644
index 0000000..764f221
--- /dev/null
+++ b/automation-health/README.md
@@ -0,0 +1,20 @@
+# automation-health
+
+Machine-generated reports from the automation programs. These files are
+**overwritten in place on every run** by their generating scripts — do not edit
+them by hand, and do not add dated copies.
+
+| File | Generated by | Cadence |
+|------|--------------|---------|
+| `link-health.md` | `scripts/link-health-scanner.sh` | per scan run |
+| `automation-health.md` | `scripts/automation-health-dashboard.sh` | per dashboard run |
+
+## Why a single overwritten file (not dated snapshots)
+
+Trends are reconstructed by replaying the file's git commit history (parent by
+parent), so each commit already captures a point-in-time snapshot. Storing dated
+copies would duplicate what git already records — the files-vs-diffs-on-Git
+anti-pattern. A future trend tool should read `git log` for these paths rather
+than expect a directory of dated files.
+
+See rossoctl/automation#44 for the decision.
diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index b61c869..9f2b692 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -76,14 +76,15 @@ fi
 # MAIN_REPO, REPOS_DIR, REMAP.
 load_org_profile
 
-# Report-PR destination. TEMPORARY: the org main repo's docs/ folder now sources
-# the docs site (rossoctl.dev), which overwrites machine-generated reports, so
-# the standing dashboard PR is redirected to docs/reports/ in the automation
-# repo. Revert to $MAIN_REPO once a permanent home is chosen
-# (rossoctl/automation#44; see rossoctl/rossoctl#2315).
+# Report-PR destination. The org main repo's docs/ folder feeds the docs site
+# (rossoctl.dev) and cannot host machine-generated reports, so the standing
+# dashboard PR lands under automation-health/ in the automation repo. A single
+# file, overwritten in place each run: trend tooling reconstructs history by
+# replaying git commit parents, so we store state (not dated snapshots) and
+# avoid the files-vs-diffs-on-Git anti-pattern (rossoctl/automation#44).
 REPORT_TARGET_REPO="$ORG/automation"
 REPORT_TARGET_NAME="${REPORT_TARGET_REPO##*/}"
-REPORT_TARGET_PATH="docs/reports/automation-health.md"
+REPORT_TARGET_PATH="automation-health/automation-health.md"
 # Clone dir for the report target: honor an explicit --main-repo-dir/MAIN_REPO_DIR
 # override, else derive from REPOS_DIR.
 REPORT_TARGET_DIR="${MAIN_REPO_DIR:-$REPOS_DIR/$REPORT_TARGET_NAME}"
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index f1d8f65..7e69335 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -42,14 +42,15 @@ load_org_profile
 # --- Configuration ---
 REPORTS_DIR="${REPORTS_DIR:-$HOME/workspaces/clawgenti/reports/link-scan}"
 
-# Report-PR destination. TEMPORARY: the org main repo's docs/ folder now
-# sources the docs site (rossoctl.dev), which overwrites machine-generated
-# reports, so the standing report PR is redirected to docs/reports/ in the
-# automation repo. Revert to $MAIN_REPO once a permanent home is chosen
-# (rossoctl/automation#44; see rossoctl/rossoctl#2315).
+# Report-PR destination. The org main repo's docs/ folder feeds the docs site
+# (rossoctl.dev) and cannot host machine-generated reports, so the standing
+# report PR lands under automation-health/ in the automation repo. A single
+# file, overwritten in place each run: trend tooling reconstructs history by
+# replaying git commit parents, so we store state (not dated snapshots) and
+# avoid the files-vs-diffs-on-Git anti-pattern (rossoctl/automation#44).
 REPORT_TARGET_REPO="$ORG/automation"
 REPORT_TARGET_NAME="${REPORT_TARGET_REPO##*/}"
-REPORT_TARGET_PATH="docs/reports/link-health.md"
+REPORT_TARGET_PATH="automation-health/link-health.md"
 
 # Clone dir for the report target: honor an explicit MAIN_REPO_DIR override,
 # else derive from REPOS_DIR.

From 5b6333f9211086a44641191640d7332130c4f261 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Wed, 5 Aug 2026 14:21:16 -0400
Subject: [PATCH 13/15] docs: Sync standing-orders with rename + report
 redirect

Bring the version-controlled standing orders in line with the
rewired scripts, the org rename, and the report-home decision so
the repo and the live schedule no longer diverge:

- org 'kagenti' -> active-org / rossoctl; drop hardcoded ~/kagenti
  clone paths in favor of 'the core repos, cloned locally'
- report destinations -> automation-health/{link-health,automation-
  health}.md in rossoctl/automation (single perpetual file; history
  via git commit history, rossoctl/automation#44)
- epic/tracking refs -> rossoctl/rossoctl#1178/#1260/#1910
- pr-review scope -> the core allowlist (config/core-repos.txt)
- add standing-orders/repo-sync.md: the previously-untracked nightly
  clone-sync order, described in org/repo terms (no host detail)
- rename the dep-bump fixer signature Kagenti -> Rossoctl (also the
  dedup marker; documented one-time duplicate-comment cost)

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/dep-bump-fixer.sh           |  6 +++++-
 standing-orders/dep-bump.md         |  8 ++++----
 standing-orders/health-dashboard.md | 11 +++++++----
 standing-orders/link-health.md      | 12 +++++++-----
 standing-orders/pr-review.md        |  6 +++---
 standing-orders/repo-sync.md        | 28 ++++++++++++++++++++++++++++
 6 files changed, 54 insertions(+), 17 deletions(-)
 create mode 100644 standing-orders/repo-sync.md

diff --git a/scripts/dep-bump-fixer.sh b/scripts/dep-bump-fixer.sh
index 4e2f0f3..2c4b486 100644
--- a/scripts/dep-bump-fixer.sh
+++ b/scripts/dep-bump-fixer.sh
@@ -74,7 +74,11 @@ REPORTS_DIR="${REPORTS_DIR:-./reports/dep-bump}"
 SCAN_DATE=$(date -u +"%Y-%m-%d")
 SCAN_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 MAX_HISTORY_ROWS=500
-FIXER_SIGNATURE="Automated analysis by Kagenti Dep Bump Fixer"
+# Marker appended to every fixer comment; also the dedup key (line 278 searches
+# existing comments for it before posting). Changing this string means comments
+# carrying the OLD marker are no longer recognized, so an already-analyzed PR
+# may receive one duplicate comment on the next run — acceptable, one-time.
+FIXER_SIGNATURE="Automated analysis by Rossoctl Dep Bump Fixer"
 
 # --- Workspace setup ---
 setup_workspace "dep-bump-fixer"
diff --git a/standing-orders/dep-bump.md b/standing-orders/dep-bump.md
index bcca0e7..879ca59 100644
--- a/standing-orders/dep-bump.md
+++ b/standing-orders/dep-bump.md
@@ -1,4 +1,4 @@
-## Program: Dep Bump (kagenti org)
+## Program: Dep Bump
 
 **Authority:** Scan repos for stale Dependabot PRs, create/close GitHub issues, write reports
 **Trigger:** Scanner Tue/Thu 7am ET (enforced via cron job `dep-bump-scanner`)
@@ -9,7 +9,7 @@
   - GitHub API rate limit hit: stop issue creation, report partial results
 
 ### Scope
-- All repositories in the kagenti GitHub org (cloned at `~/kagenti/`)
+- The core repositories under the active org (see `config/core-repos.txt`), cloned locally
 - Only open Dependabot PRs (state=open, author=app/dependabot)
 - Coverage audit of .github/dependabot.yml vs detected ecosystems
 
@@ -28,7 +28,7 @@
 ### Operational Notes — Fixer
 - Cron job: `dep-bump-fixer` (Tue/Thu 12pm ET / 16:00 UTC, isolated — 2h after scanner)
 - Reports: `reports/dep-bump/fixer-latest.json`, `reports/dep-bump/fixer-history.json`, `reports/dep-bump/baseline.json`
-- Fixer signature: `_Automated analysis by Kagenti Dep Bump Fixer_`
+- Fixer signature: `_Automated analysis by Rossoctl Dep Bump Fixer_`
 - Manual run: `openclaw cron run dep-bump-fixer`
 - The fixer does NOT merge PRs — it comments with analysis to accelerate human decisions
 - Duplicate prevention: checks for existing fixer signature before posting
@@ -42,4 +42,4 @@ All cron jobs maintain 1h+ separation to avoid crowding Discord:
 - Health dashboard: Daily 17:00 UTC (1pm ET)
 
 ### Epic
-- kagenti/kagenti#1260
+- rossoctl/rossoctl#1260
diff --git a/standing-orders/health-dashboard.md b/standing-orders/health-dashboard.md
index 58b4288..d5c441e 100644
--- a/standing-orders/health-dashboard.md
+++ b/standing-orders/health-dashboard.md
@@ -1,4 +1,4 @@
-## Program: Automation Health Dashboard (kagenti org)
+## Program: Automation Health Dashboard
 
 **Authority:** Generate executive-facing dashboard combining all automation program metrics
 **Trigger:** Daily 1pm ET (enforced via cron job `health-dashboard`)
@@ -7,7 +7,7 @@
 
 ### Scope
 - Reads reports from all automation programs (link-health, dep-bump)
-- Generates `docs/automation-health.md` in kagenti/kagenti
+- Generates `automation-health/automation-health.md` in `rossoctl/automation`
 - Pushes via standing fork-based PR (branch: `automation/health-dashboard`)
 
 ### What NOT to Do
@@ -17,12 +17,15 @@
 
 ### Operational Notes
 - Cron job: `health-dashboard` (daily 1pm ET / 17:00 UTC, isolated)
-- Output: `docs/automation-health.md` in standing PR
+- Output: `automation-health/automation-health.md` in the standing PR (single file,
+  overwritten in place; history in git commit history — rossoctl/automation#44)
 - Fork branch: `automation/health-dashboard`
+- Report-target clone: pass `--main-repo-dir` (the local `automation` clone) so the
+  dashboard finds the repo it commits into
 - Manual run: `openclaw cron run health-dashboard`
 
 ### Schedule Coordination
 See [dep-bump.md](dep-bump.md#schedule-coordination) for the full cron schedule grid.
 
 ### Epic
-- kagenti/kagenti#1260
+- rossoctl/rossoctl#1260
diff --git a/standing-orders/link-health.md b/standing-orders/link-health.md
index d9368f8..53f5841 100644
--- a/standing-orders/link-health.md
+++ b/standing-orders/link-health.md
@@ -1,6 +1,6 @@
-## Program: Link Health (kagenti org)
+## Program: Link Health
 
-**Authority:** Scan repos for broken links, create/update GitHub issues, write reports, update docs/link-health.md
+**Authority:** Scan repos for broken links, create/update GitHub issues, write reports, update the link-health report
 **Trigger:** Scanner Mon/Wed/Fri 6am ET (enforced via cron job `link-health-scanner`)
 **Approval gate:** None for issues or report updates.
 **Escalation:**
@@ -9,7 +9,7 @@
   - GitHub API rate limit hit: stop issue creation, report partial results
 
 ### Scope
-- All repositories in the kagenti GitHub org (cloned at `~/kagenti/`)
+- The core repositories under the active org (see `config/core-repos.txt`), cloned locally
 - Only documentation files: markdown (.md), HTML, and config files with URLs
 - Uses existing .lychee.toml in each repo when present; falls back to default config
 
@@ -22,7 +22,9 @@
 ### Operational Notes
 - Cron job: `link-health-scanner` (Mon/Wed/Fri 6am ET, isolated)
 - Reports: `reports/link-scan/latest.json` and `reports/link-scan/history.json`
-- Dashboard: `docs/link-health.md` in kagenti/kagenti (via `link-health/reports` branch PR)
+- Report PR: `automation-health/link-health.md` in `rossoctl/automation` (via the
+  `link-health/reports` branch, standing fork PR). Single file, overwritten in
+  place each run; history lives in git commit history (rossoctl/automation#44).
 - Labels: `broken-link/internal`, `broken-link/external`, `broken-link/unfixable`
 - Manual run: `openclaw cron run link-health-scanner`
-- Epic: kagenti/kagenti#1178
+- Epic: rossoctl/rossoctl#1178
diff --git a/standing-orders/pr-review.md b/standing-orders/pr-review.md
index 7983929..327af32 100644
--- a/standing-orders/pr-review.md
+++ b/standing-orders/pr-review.md
@@ -1,4 +1,4 @@
-## Program: PR Review (kagenti org)
+## Program: PR Review
 
 **Authority:** Review PRs labeled `ready-for-ai-review`, post review comments
 **Trigger:** Scanner every 15 min; fixer every 15 min (offset ~5 min)
@@ -6,10 +6,10 @@
 **Identity:** clawgenti (single identity, no switching)
 **Approval gate:** None. Comments only, never blocks merge.
 **Branding:** "Clawgenti Code Review"
-**Tracking:** kagenti/kagenti#1910
+**Tracking:** rossoctl/rossoctl#1910
 
 ### Scope
-- Repositories: kagenti/kagenti, kagenti/kagenti-extensions (initial rollout)
+- Repositories: the core allowlist (see `config/core-repos.txt`)
 - Only open PRs with the `ready-for-ai-review` label
 - Uses the `github:pr-review` skill
 
diff --git a/standing-orders/repo-sync.md b/standing-orders/repo-sync.md
new file mode 100644
index 0000000..91ea9cf
--- /dev/null
+++ b/standing-orders/repo-sync.md
@@ -0,0 +1,28 @@
+## Program: Repo Sync
+
+**Authority:** Keep the local repository clones current so the scanner/fixer
+programs operate on up-to-date working copies.
+**Trigger:** Daily (enforced via cron job `repo-sync`).
+**Approval gate:** None (read-only clone/pull; no writes to GitHub).
+**Escalation:** None. A repo that fails to clone or pull is logged; the sync
+continues with the rest.
+
+### Scope
+- The repositories under the active org (`ORG`). Enumerate the current set with
+  `gh repo list <org> --limit 100 --json nameWithOwner --jq '.[].nameWithOwner'`.
+- Clones into the local clones directory (`REPOS_DIR`) any repo not already
+  present; then runs `git pull` in each existing clone to bring it current.
+
+### What NOT to Do
+- Do not push, open PRs, or otherwise write to any GitHub repo.
+- Do not delete or reset local clones with uncommitted state — pull only.
+- Do not clone outside the active org.
+
+### Operational Notes
+- Cron job: `repo-sync` (daily, isolated).
+- The clone-dir basenames may lag behind canonical repo names during an org
+  rename; the scanner/fixer programs reconcile this via the transitional
+  `REMAP` in the org profile (`config/org.env`) and `canonical_repo_for_dir()`.
+  The remap self-retires once clone dirs are renamed (rossoctl/automation#37).
+- Org selection follows the same profile as the rest of the suite: the sync
+  should target the same `ORG` the scanners use, so coverage stays consistent.

From 88a2c811c6c7e2b2cc86196a500d51aa6c8c78f5 Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Wed, 5 Aug 2026 15:41:39 -0400
Subject: [PATCH 14/15] feat: Brand report PRs and link their standing orders

Report-PR bodies now identify the invoking program and link to its
standing order in the source repo, so a human reading the PR can
trace which automation program produced it.

- rename remaining Kagenti display strings -> Rossoctl (PR openers +
  report footers) for the link-health scanner and dashboard
- add a '## Automation program' section with a minimal inline link:
  Generated by the [Rossoctl <Program>](<standing-order-url>)
- add SOURCE_REPO to load_org_profile (flag/env/profile/default,
  default $ORG/automation): the repo where scripts/skills/standing
  orders live, used to build the standing-order URL portably so a
  fork points at its own automation repo without editing scripts
- document optional PROFILE_SOURCE_REPO in config/org.env
- gitignore .host-backup/ (local off-host copies of cron/job state)

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 .gitignore                             |  3 +++
 config/org.env                         |  6 ++++++
 scripts/automation-health-dashboard.sh | 10 +++++++---
 scripts/link-health-scanner.sh         |  8 ++++++--
 scripts/program-lib.sh                 |  7 ++++++-
 5 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 6c7f643..5e80c5f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,5 @@
 reports/
 *.log
+
+# Local copies of host cron/job state (contains deployment internals; never commit)
+.host-backup/
diff --git a/config/org.env b/config/org.env
index 488f778..cf841ba 100644
--- a/config/org.env
+++ b/config/org.env
@@ -13,6 +13,12 @@ PROFILE_FORK_OWNER=clawgenti
 PROFILE_MAIN_REPO=rossoctl/rossoctl
 PROFILE_REPOS_DIR=${HOME}/rossoctl
 
+# Repo where this suite (scripts, skills, standing orders) is version-controlled.
+# Report PRs link back to the invoking program's standing order here for
+# auditability. Defaults to "$ORG/automation" if unset; override if a fork keeps
+# its automation elsewhere.
+# PROFILE_SOURCE_REPO=rossoctl/automation
+
 # TRANSITIONAL: maps pre-rename clone-dir basenames to canonical repo names.
 # Self-retires once host clone dirs are renamed (rossoctl/automation#37):
 # delete this line and the remap becomes pure identity.
diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index 9f2b692..b253e65 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -443,7 +443,7 @@ $COVERAGE_TABLE
 $CRON_TABLE
 
 ---
-*Generated by Kagenti Automation Health Dashboard. Do not edit manually.*
+*Generated by Rossoctl Automation Health Dashboard. Do not edit manually.*
 DASHBOARD_EOF
 
 echo "Dashboard generated ($TMPDIR/automation-health.md)"
@@ -503,7 +503,7 @@ else
 
   pr_body="## Summary
 
-Auto-updated by Kagenti Automation Health Dashboard. This PR is continuously updated with each generation. Merge when convenient.
+Auto-updated by Rossoctl Automation Health Dashboard. This PR is continuously updated with each generation. Merge when convenient.
 
 | Metric | Value |
 |--------|-------|
@@ -514,7 +514,11 @@ Auto-updated by Kagenti Automation Health Dashboard. This PR is continuously upd
 
 ## Related issue(s)
 
-- $MAIN_REPO#1260"
+- $MAIN_REPO#1260
+
+## Automation program
+
+Generated by the [Rossoctl Automation Health Dashboard](https://github.com/$SOURCE_REPO/blob/main/standing-orders/health-dashboard.md)."
 
   if [ -z "$existing_pr" ] || [ "$existing_pr" = "null" ]; then
     gh pr create --repo "$REPORT_TARGET_REPO" \
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 7e69335..2a07768 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -491,7 +491,7 @@ else
 
   pr_body="## Summary
 
-Auto-updated by Kagenti Link Health Scanner. This PR is continuously updated with each scan. Merge when convenient.
+Auto-updated by Rossoctl Link Health Scanner. This PR is continuously updated with each scan. Merge when convenient.
 
 | Metric | Value |
 |--------|-------|
@@ -503,7 +503,11 @@ Auto-updated by Kagenti Link Health Scanner. This PR is continuously updated wit
 
 ## Related issue(s)
 
-- $MAIN_REPO#1178"
+- $MAIN_REPO#1178
+
+## Automation program
+
+Generated by the [Rossoctl Link Health Scanner](https://github.com/$SOURCE_REPO/blob/main/standing-orders/link-health.md)."
 
   if [ -z "$existing_pr" ] || [ "$existing_pr" = "null" ]; then
     gh pr create --repo "$REPORT_TARGET_REPO" \
diff --git a/scripts/program-lib.sh b/scripts/program-lib.sh
index 2123380..a86204a 100644
--- a/scripts/program-lib.sh
+++ b/scripts/program-lib.sh
@@ -850,12 +850,17 @@ load_org_profile() {
   FORK_OWNER="${FORK_OWNER_FLAG:-${FORK_OWNER:-${PROFILE_FORK_OWNER:-clawgenti}}}"
   MAIN_REPO="${MAIN_REPO_FLAG:-${MAIN_REPO:-${PROFILE_MAIN_REPO:-$ORG/$ORG}}}"
   REPOS_DIR="${REPOS_DIR_FLAG:-${REPOS_DIR:-${PROFILE_REPOS_DIR:-$HOME/$ORG}}}"
+  # SOURCE_REPO: the owner/name of the repo where this suite (scripts, skills,
+  # standing orders) is version-controlled. Used to link report PRs back to the
+  # invoking program's standing order for auditability. Defaults to the
+  # automation repo under the active org; a fork can override to its own.
+  SOURCE_REPO="${SOURCE_REPO_FLAG:-${SOURCE_REPO:-${PROFILE_SOURCE_REPO:-$ORG/automation}}}"
   # REMAP is profile-only by design (no flag/env tier): it is a transitional
   # field that self-retires once clone dirs are renamed (rossoctl/automation#37),
   # so it never earns a durable --flag/env knob. An exported REMAP is ignored.
   REMAP="${PROFILE_REMAP:-}"
 
-  export ORG FORK_OWNER MAIN_REPO REPOS_DIR REMAP
+  export ORG FORK_OWNER MAIN_REPO REPOS_DIR SOURCE_REPO REMAP
 }
 
 # Print the core repo allowlist, one "owner/name" per line.

From 55034e14f467fe66b96c3ab1b97d750dd68040aa Mon Sep 17 00:00:00 2001
From: Gloire Rubambiza <gloire@ibm.com>
Date: Thu, 6 Aug 2026 10:56:22 -0400
Subject: [PATCH 15/15] fix: Harden report-fork remote, drop KAGENTI_DIR alias

Address clawgenti review on #47:

- link-health-scanner: drop the hardcoded 'clawgenti-kagenti-fork'
  FORK_REMOTE literal (now $FORK_OWNER-automation-fork, org-neutral).
- both report writers: register the fork remote with 'set-url || add'
  instead of guard-then-skip, so a stale remote left by a prior
  deployment (pointing at the old report repo) is corrected rather
  than silently pushed to the wrong target.
- dashboard: remove the KAGENTI_DIR env alias and the --kagenti-dir
  flag entirely. The host cron no longer passes either (Task 11
  switched it to --main-repo-dir), so the alias only guarded a
  scenario that no longer exists; --main-repo-dir/MAIN_REPO_DIR is
  now the sole interface, leaving no org-named knob.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
---
 scripts/automation-health-dashboard.sh | 16 +++++++---------
 scripts/link-health-scanner.sh         | 14 +++++++++-----
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/scripts/automation-health-dashboard.sh b/scripts/automation-health-dashboard.sh
index b253e65..45a67cb 100644
--- a/scripts/automation-health-dashboard.sh
+++ b/scripts/automation-health-dashboard.sh
@@ -20,7 +20,7 @@ source "$SCRIPT_DIR/program-lib.sh"
 DRY_RUN=true
 VERBOSE=false
 SHOW_HELP=false
-MAIN_REPO_DIR="${MAIN_REPO_DIR:-${KAGENTI_DIR:-}}"
+MAIN_REPO_DIR="${MAIN_REPO_DIR:-}"
 
 while [[ $# -gt 0 ]]; do
   case $1 in
@@ -28,9 +28,6 @@ while [[ $# -gt 0 ]]; do
     --live) DRY_RUN=false; shift ;;
     --reports-dir) REPORTS_DIR="$2"; shift 2 ;;
     --main-repo-dir) MAIN_REPO_DIR="$2"; shift 2 ;;
-    --kagenti-dir)   # deprecated alias, remove after one release
-      echo "WARN: --kagenti-dir is deprecated; use --main-repo-dir" >&2
-      MAIN_REPO_DIR="$2"; shift 2 ;;
     --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --org) ORG_FLAG="$2"; shift 2 ;;
     --fork-owner) FORK_OWNER_FLAG="$2"; shift 2 ;;
@@ -56,7 +53,6 @@ Options:
   --reports-dir DIR    Base reports directory (default: $REPORTS_DIR or ./reports)
   --main-repo-dir DIR  Path to the report-target repo clone, overriding the
                        REPOS_DIR-derived default (default: $MAIN_REPO_DIR)
-  --kagenti-dir DIR    Deprecated alias for --main-repo-dir
   --profile NAME       Org profile to load (config/org.<name>.env; default org.env)
   --org NAME           GitHub org (default: from profile, config/org.env)
   --fork-owner NAME    Fork owner for PR workflow (default: from profile)
@@ -477,10 +473,12 @@ else
 
   cd "$REPORT_TARGET_DIR"
 
-  # Ensure fork remote exists
-  if ! git remote get-url "$FORK_REMOTE" &>/dev/null; then
-    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${REPORT_TARGET_NAME}.git"
-  fi
+  # Ensure the fork remote exists AND points at the current target. set-url
+  # corrects a stale remote (e.g. one left by a prior deployment pointing at the
+  # old report repo); the || add branch handles the not-yet-registered case.
+  fork_url="https://github.com/$FORK_OWNER/${REPORT_TARGET_NAME}.git"
+  git remote set-url "$FORK_REMOTE" "$fork_url" 2>/dev/null \
+    || git remote add "$FORK_REMOTE" "$fork_url"
 
   # Fetch fork's branch if it exists, otherwise create from main
   if git fetch "$FORK_REMOTE" "$DASHBOARD_BRANCH" 2>/dev/null; then
diff --git a/scripts/link-health-scanner.sh b/scripts/link-health-scanner.sh
index 2a07768..583e5b8 100755
--- a/scripts/link-health-scanner.sh
+++ b/scripts/link-health-scanner.sh
@@ -56,7 +56,9 @@ REPORT_TARGET_PATH="automation-health/link-health.md"
 # else derive from REPOS_DIR.
 REPORT_TARGET_DIR="${MAIN_REPO_DIR:-$REPOS_DIR/$REPORT_TARGET_NAME}"
 
-FORK_REMOTE="clawgenti-kagenti-fork"
+# Fork remote name for the report-target push. Derived from the profile so it
+# carries no org literal; a stale remote of this name is corrected below.
+FORK_REMOTE="$FORK_OWNER-automation-fork"
 SCAN_DATE=$(date -u +"%Y-%m-%d")
 SCAN_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 MAX_HISTORY_ROWS=500
@@ -465,10 +467,12 @@ else
 
   cd "$REPORT_TARGET_DIR"
 
-  # Ensure fork remote exists
-  if ! git remote get-url "$FORK_REMOTE" &>/dev/null; then
-    git remote add "$FORK_REMOTE" "https://github.com/$FORK_OWNER/${REPORT_TARGET_NAME}.git"
-  fi
+  # Ensure the fork remote exists AND points at the current target. set-url
+  # corrects a stale remote (e.g. one left by a prior deployment pointing at the
+  # old report repo); the || add branch handles the not-yet-registered case.
+  fork_url="https://github.com/$FORK_OWNER/${REPORT_TARGET_NAME}.git"
+  git remote set-url "$FORK_REMOTE" "$fork_url" 2>/dev/null \
+    || git remote add "$FORK_REMOTE" "$fork_url"
 
   # Fetch fork's branch if it exists, otherwise create from main
   if git fetch "$FORK_REMOTE" link-health/reports 2>/dev/null; then