[oblt-aw] Control Plane Dashboard

## Control Plane Dashboard

Use this dashboard to enable or disable agentic workflows for this repository.
Click the checkboxes below to toggle workflows on or off.

### Observability (obs)

| Workflow | Maturity | Description |
|----------|----------|-------------|
| [Agent Suggestions](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-agent-suggestions.md) | 🟠 experimental | Suggests agentic workflows and improvements for the repository based on analysis of current setup. inner-workflows: `obs-aw-agent-suggestions.yml` |
| [Automated Documentation](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-autodoc.md) | 🟢 stable | Analyzes documentation for gaps, outdated content, and inconsistencies; creates issues and PRs to improve docs. inner-workflows: `obs-aw-autodoc.yml` |
| [Automerge](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-automerge.md) | 🟢 stable | Enables auto-merge for allowed bot PRs (same authors as dependency-review) with oblt-aw/ai/merge-ready when validation and approval gates pass; GitHub enforces required checks at merge time. inner-workflows: `obs-aw-automerge.yml` |
| [Dependency Review](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-dependency-review.md) | 🟢 stable | Analyzes dependency-update PRs from bots, applies merge-ready labels when criteria are met. inner-workflows: `obs-aw-dependency-review.yml` |
| [Duplicate Issue Detector](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-duplicate-issue-detector.md) | 🟠 experimental | Detects potential duplicate issues when a new issue is opened or when the entrypoint is run manually. inner-workflows: `obs-aw-duplicate-issue-detector.yml` |
| [Issue Triage](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-issue-triage.md) | 🟡 early-adoption | Triages newly opened issues using the generic issue-triage agentic workflow. inner-workflows: `obs-aw-issue-triage.yml` |
| [Issue Fixer](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-issue-fixer.md) | 🟠 experimental | Executes generic issue fixes requested with /ai implement comments, excluding specialized security and resource-not-accessible flows. inner-workflows: `obs-aw-issue-fixer.yml` |
| [Mention in Issue](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-mention-in-issue.md) | 🟡 early-adoption | AI assistant for issues — answers questions, debugs problems, and creates PRs on demand when triggered with a /ai comment. inner-workflows: `obs-aw-mention-in-issue.yml` |
| [Security](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-security-detector.md) | 🟡 early-adoption | Runs static security checks on workflows, shell scripts, and dependency manifests per the security scanning ruleset; opens issues for findings. inner-workflows: `obs-aw-security-fixer.yml`, `obs-aw-security-issue-superseder.yml`, `obs-aw-security-triage.yml`, `obs-aw-security-injection-detector.yml`, `obs-aw-security-supply-chain-detector.yml`, `obs-aw-security-secrets-detector.yml`, `obs-aw-security-least-privilege-detector.yml` |
| [Resource Not Accessible by Integration](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-resource-not-accessible-by-integration-detector.md) | 🟡 early-adoption | Detects 'Resource not accessible by integration' occurrences in workflow logs, creates triage issues, triages newly opened issues, and executes fixes for issues labeled ready to fix. inner-workflows: `obs-aw-resource-not-accessible-by-integration-detector.yml`, `obs-aw-resource-not-accessible-by-integration-fixer.yml`, `obs-aw-resource-not-accessible-by-integration-triage.yml` |
| [PR Buildkite Detective](https://github.com/elastic/oblt-aw/blob/main/docs/workflows/obs-aw-estc-pr-buildkite-detective.md) | 🟢 stable | Analyzes Buildkite CI failures for a PR when a Buildkite status check fails; posts a diagnostic comment on the pull request. inner-workflows: `obs-aw-estc-pr-buildkite-detective.yml` |

#### Enable / Disable

Click a checkbox to enable or disable a workflow:

- [ ] Agent Suggestions
- [x] Automated Documentation
- [x] Automerge
- [x] GitHub Actions bumps
- [x] pre-commit hook updates
- [ ] Python dependencies
- [ ] Go dependencies
- [ ] Node dependencies
- [x] Terraform / OpenTofu
- [x] Open Policy Agent
- [ ] VM / container images
- [ ] Dependency Review
- [ ] Duplicate Issue Detector
- [ ] Issue Triage
- [ ] Issue Fixer
- [ ] Mention in Issue
- [ ] Security
- [x] Injection Detection
- [x] Supply-chain Hardening
- [x] Secret Management
- [x] Least Privilege
- [ ] Resource Not Accessible by Integration
- [x] PR Buildkite Detective

### Instructions

- **Enable a workflow:** Check the checkbox next to the workflow.
- **Disable a workflow:** Uncheck the checkbox, then reply on this issue with a short **deactivation reason** (an audit comment will ask for it and mention @elastic/observablt-ci).
- **Sub-features:** Indented checkboxes under a parent refine which parts of that workflow run. Sub-features take effect only while the parent workflow checkbox is enabled.
- **Audit trail:** Enable/disable changes are recorded as comments on this issue (when / what / who).
- Changes are applied at runtime when the client runs.

The issue body is a control-plane dashboard and names no source files, tests, or specific change to make. Start by reviewing the Enable / Disable and Instructions sections; a concrete workflow change and its expected runtime effect would need to be identified before “done” can be defined.

Written by the indexing model from the issue text.