Begin work on a GitHub issue: clone the target repository into a fresh, isolated per-issue workspace and create (or, if one already exists, resume) a selfdev/issue-<issue_number> branch there. Call this first, before read_file, write_file, run_tests, or submit_pr -- those tools all operate on the workspace this creates. Only one active workspace is allowed per issue; calling this again for an issue that already has one returns an error instead of clobbering it. Returns the branch name as a plain string on success, or a string starting "ERROR:" on failure (never raises).

Read a file's contents from the workspace start_issue created for this issue. relative_path is resolved relative to that workspace and is refused if it is absolute, has a drive letter, is a UNC path, escapes the workspace via '..', or touches '.git'. Returns the file contents as a plain string on success, "REFUSED: ..." if the path is blocked, or "ERROR: ..." for other failures (e.g. no active workspace, file not found) -- never raises.

Create or overwrite a file inside the workspace start_issue created for this issue. relative_path is checked the same way as read_file (no absolute/drive/UNC/'..'/'.git' paths) and is additionally checked against the fleet manifest's protected paths. Writes are capped per issue (default 5 attempts, configurable via SELF_DEV_MAX_ATTEMPTS); a refused write does not count against that cap. Returns "OK" on success, "REFUSED: ..." for a blocked path, "EXHAUSTED: ..." once the attempt cap is reached, or "ERROR: ..." for other failures -- never raises.

Run the target repository's own pytest suite for one service, inside the issue's workspace, subject to a timeout. This only executes tests and reports the result -- it never commits or modifies anything. Returns a string starting "OK" or "FAILED" followed by the exit code and captured stdout/stderr, "REFUSED: ..." if the path is option-like, escapes the workspace, or touches '.git', or "ERROR: ..." if the run times out or fails to start -- never raises.

Finish work on an issue: commit everything currently in the workspace, push the selfdev/issue-<issue_number> branch, and open a new pull request or reuse an already-open one for that branch -- then destroy the workspace. It can never merge a pull request and never force-pushes. Requires a GitHub repository to be configured. Returns "opened PR #" on success, or a string starting "ERROR:" on failure (the workspace is kept on failure so a retry doesn't need start_issue again) -- never raises.

List open GitHub issues carrying the given label; pull requests are excluded even though GitHub's issues API would otherwise include them. Use this to discover work before calling start_issue. Returns one "# " line per matching issue, a "No open issues labeled " message if none match, or a string starting "ERROR:" on failure -- never raises.

Get the combined CI status for a pull request's head commit, from GitHub's Checks API. Returns exactly one of "pending" (no checks yet, or some still running), "success" (all checks completed without failure), or "failure" (at least one check reported a non-success conclusion: failed, cancelled, timed out, required action, or failed to start) -- or a string starting "ERROR:" if the status can't be retrieved (never raises).