No CI job in any of four repos crosses a repo boundary (cycle 4)

[sroussey]

grep -rn 'repository:' {libs,sec,builder,embarc-data}/.github/workflows/* returns nothing. No workflow checks out another repo, so an API-shape change is only discovered when a consumer writes code against it — which this window cost two live defects:

• runWorkglowCli discards models and providers its own registerTasks hook registered #856 — runWorkglowCli discarding hook-registered models (sec-base model list → "No models found").
• registerCommonTasks() has no declared return type, so any membership test is a TS2345 — builder main is red on it #855 — registerCommonTasks()'s inferred union leaving workglow-dev/builder@main red for four days.

Proposal: a downstream job on push: branches: [main] — actions/checkout ×3 into libs/, sec/ (repository: workglow-dev/sec), builder/; bun i + bun run build + bun run link-all in libs; then bun run build in sec and bun run types in builder against the linked build. No test suites; ~35 lines.

Pair it with git mv .github/workflows/publish-preview.yml-off .github/workflows/publish-preview.yml — the file is complete and working (bunx pkg-pr-new publish ./packages/* ./providers/* ./examples/cli) and has been disabled by file extension for four cycles. It is what makes a "must be published first" gate cheap instead of a nine-day wait.

Recommended on 2026-08-03, 08-10, 08-17 and now 08-24. Snapshot: workglow-dev/prd → analysis/grades/2026-08-24/cross-repo-integration.md.