diff --git a/src/pm/integration.ts b/src/pm/integration.ts
index 3f1eeb58..9b0e64ed 100644
--- a/src/pm/integration.ts
+++ b/src/pm/integration.ts
@@ -12,6 +12,7 @@
 import { PROVIDER_CREDENTIAL_ROLES } from '../config/integrationRoles.js';
 import { getIntegrationCredentialOrNull } from '../config/provider.js';
 import { getIntegrationProvider } from '../db/repositories/credentialsRepository.js';
+import type { AgentExecutionConfig } from '../triggers/shared/agent-execution.js';
 import type { CascadeConfig, ProjectConfig } from '../types/index.js';
 import type { ProjectPMConfig } from './lifecycle.js';
 import type { PMProvider } from './types.js';
@@ -46,6 +47,12 @@ export interface PMIntegration {
 	/** Extract normalized lifecycle config (labels, statuses) from provider-specific config */
 	resolveLifecycleConfig(project: ProjectConfig): ProjectPMConfig;
 
+	/**
+	 * Optional: Provide source-specific AgentExecutionConfig overrides.
+	 * Used by GitHub to skip PM lifecycle steps (since GitHub agents are PR-based, not card-based).
+	 */
+	resolveExecutionConfig?(): AgentExecutionConfig;
+
 	// --- Webhook processing ---
 	/** Parse a raw webhook body into a normalized event, or null if irrelevant */
 	parseWebhookPayload(raw: unknown): PMWebhookEvent | null;
diff --git a/src/pm/webhook-handler.ts b/src/pm/webhook-handler.ts
index bf0af358..0d13b273 100644
--- a/src/pm/webhook-handler.ts
+++ b/src/pm/webhook-handler.ts
@@ -7,12 +7,8 @@
  * ack comment management) is delegated to the PMIntegration interface.
  */
 
-import { withEmailIntegration } from '../email/index.js';
-import { withGitHubToken } from '../github/client.js';
-import { getPersonaToken } from '../github/personas.js';
-import { withSmsIntegration } from '../sms/index.js';
 import type { TriggerRegistry } from '../triggers/registry.js';
-import { runAgentExecutionPipeline } from '../triggers/shared/agent-execution.js';
+import { runAgentWithCredentials } from '../triggers/shared/webhook-execution.js';
 import { processNextQueuedWebhook } from '../triggers/shared/webhook-queue.js';
 import type { TriggerResult } from '../triggers/types.js';
 import type {
@@ -32,7 +28,6 @@ import {
 	setProcessing,
 	startWatchdog,
 } from '../utils/index.js';
-import { injectLlmApiKeys } from '../utils/llmEnv.js';
 import { getPMProvider, withPMProvider } from './context.js';
 import type { PMIntegration } from './integration.js';
 import { PMLifecycleManager, resolveProjectPMConfig } from './lifecycle.js';
@@ -48,25 +43,10 @@ async function executeAgent(
 	project: ProjectConfig,
 	config: CascadeConfig,
 ): Promise<void> {
-	if (!result.agentType) return;
-	const githubToken = await getPersonaToken(project.id, result.agentType);
-	const restoreLlmEnv = await injectLlmApiKeys(project.id);
-
-	try {
-		await integration.withCredentials(project.id, () =>
-			withEmailIntegration(project.id, () =>
-				withSmsIntegration(project.id, () =>
-					withGitHubToken(githubToken, () =>
-						runAgentExecutionPipeline(result, project, config, {
-							logLabel: `${integration.type} agent`,
-						}),
-					),
-				),
-			),
-		);
-	} finally {
-		restoreLlmEnv();
-	}
+	// Allow integrations to provide source-specific AgentExecutionConfig overrides
+	// (e.g. GitHubWebhookIntegration skips PM lifecycle steps).
+	const executionConfig = integration.resolveExecutionConfig?.();
+	await runAgentWithCredentials(integration, result, project, config, executionConfig);
 }
 
 // ============================================================================
diff --git a/src/triggers/github/ack-comments.ts b/src/triggers/github/ack-comments.ts
new file mode 100644
index 00000000..4393e61d
--- /dev/null
+++ b/src/triggers/github/ack-comments.ts
@@ -0,0 +1,121 @@
+/**
+ * GitHub acknowledgment comment helpers.
+ *
+ * Handles posting, deleting, and updating PR comments that acknowledge
+ * incoming webhook events and report agent status.
+ */
+
+import { INITIAL_MESSAGES } from '../../config/agentMessages.js';
+import { githubClient } from '../../github/client.js';
+import { extractGitHubContext, generateAckMessage } from '../../router/ackMessageGenerator.js';
+import type { AgentResult, ProjectConfig } from '../../types/index.js';
+import { parseRepoFullName } from '../../utils/repo.js';
+import { safeOperation } from '../../utils/safeOperation.js';
+import type { TriggerResult } from '../types.js';
+
+/**
+ * Delete the progress comment after a successful non-implementation agent run.
+ *
+ * The implementation agent's success is handled via lifecycle (handleSuccess),
+ * which manages the PR comment separately.
+ */
+export async function deleteProgressCommentOnSuccess(
+	result: TriggerResult,
+	_agentResult: AgentResult,
+): Promise<void> {
+	if (result.agentType === 'implementation') return;
+
+	const input = result.agentInput as { repoFullName?: string };
+	if (!input.repoFullName || !result.prNumber) return;
+
+	let owner: string;
+	let repo: string;
+	try {
+		({ owner, repo } = parseRepoFullName(input.repoFullName));
+	} catch {
+		return;
+	}
+
+	const { getSessionState } = await import('../../gadgets/sessionState.js');
+	const { initialCommentId } = getSessionState();
+	if (!initialCommentId) return;
+
+	await safeOperation(() => githubClient.deletePRComment(owner, repo, initialCommentId), {
+		action: 'delete progress comment after agent success',
+		prNumber: result.prNumber,
+	});
+}
+
+/**
+ * Update the initial PR comment with an error message when the agent fails.
+ */
+export async function updateInitialCommentWithError(
+	result: TriggerResult,
+	agentResult: { success: boolean; error?: string },
+): Promise<void> {
+	const input = result.agentInput as { repoFullName?: string };
+	if (!input.repoFullName || !result.prNumber) return;
+
+	let owner: string;
+	let repo: string;
+	try {
+		({ owner, repo } = parseRepoFullName(input.repoFullName));
+	} catch {
+		return;
+	}
+
+	const { getSessionState } = await import('../../gadgets/sessionState.js');
+	const { initialCommentId } = getSessionState();
+	if (!initialCommentId) return;
+
+	const errorMessage = agentResult.error || 'Agent completed without making changes';
+	const body = `⚠️ **${result.agentType} agent failed**\n\n${errorMessage}\n\n<sub>Manual intervention may be required.</sub>`;
+
+	await safeOperation(() => githubClient.updatePRComment(owner, repo, initialCommentId, body), {
+		action: 'update PR comment with error',
+		prNumber: result.prNumber,
+	});
+}
+
+/**
+ * Post an acknowledgment comment on the PR.
+ *
+ * Generates an LLM-based ack message contextual to the event, falling back
+ * to static INITIAL_MESSAGES on failure. Injects ackCommentId and ackMessage
+ * into the result's agentInput so the agent can pre-seed its ProgressMonitor.
+ */
+export async function postAcknowledgmentComment(
+	result: TriggerResult,
+	payload: unknown,
+	eventType: string,
+	project: ProjectConfig,
+): Promise<void> {
+	if (!result.agentType || !result.prNumber) {
+		return;
+	}
+	const input = result.agentInput as {
+		repoFullName?: string;
+	};
+	if (!input.repoFullName) {
+		return;
+	}
+	const { owner, repo } = parseRepoFullName(input.repoFullName);
+	const prNumber = result.prNumber;
+
+	let message: string;
+	try {
+		const context = extractGitHubContext(payload, eventType);
+		message = await generateAckMessage(result.agentType, context, project.id);
+	} catch {
+		message = INITIAL_MESSAGES[result.agentType] ?? INITIAL_MESSAGES.implementation;
+	}
+
+	const comment = await safeOperation(
+		() => githubClient.createPRComment(owner, repo, prNumber, message),
+		{ action: 'post acknowledgment comment', prNumber },
+	);
+	if (comment) {
+		result.agentInput.ackCommentId = comment.id;
+		result.agentInput.ackMessage = message;
+	}
+}
diff --git a/src/triggers/github/check-polling.ts b/src/triggers/github/check-polling.ts
new file mode 100644
index 00000000..f2395ce0
--- /dev/null
+++ b/src/triggers/github/check-polling.ts
@@ -0,0 +1,46 @@
+/**
+ * GitHub CI check polling.
+ *
+ * Polls until all CI checks pass before allowing an agent to start.
+ * Used when a trigger sets `waitForChecks: true`.
+ */
+
+import { withGitHubToken } from '../../github/client.js';
+import { logger } from '../../utils/index.js';
+import { parseRepoFullName } from '../../utils/repo.js';
+import type { TriggerResult } from '../types.js';
+
+/**
+ * Poll until all CI checks pass before starting the agent.
+ * Returns false if checks don't pass after polling (agent should be skipped).
+ */
+export async function pollWaitForChecks(
+	result: TriggerResult,
+	repoFullName: string,
+	githubToken: string,
+): Promise<boolean> {
+	const { waitForChecks } = await import('./check-suite-success.js');
+	const { owner, repo } = parseRepoFullName(repoFullName);
+	const headSha = result.agentInput.headSha as string;
+	const prNumber = result.prNumber ?? 0;
+
+	logger.info('Waiting for all checks to pass before starting agent', { prNumber, headSha });
+
+	const checkStatus = await withGitHubToken(githubToken, () =>
+		waitForChecks(owner, repo, headSha, prNumber),
+	);
+
+	if (!checkStatus.allPassing) {
+		logger.info('Not all checks passing after polling, skipping agent', {
+			prNumber,
+			headSha,
+			failedChecks: checkStatus.checkRuns
+				.filter((c) => c.conclusion !== 'success')
+				.map((c) => c.name),
+		});
+		return false;
+	}
+
+	logger.info('All checks passing, proceeding with agent', { prNumber });
+	return true;
+}
diff --git a/src/triggers/github/integration.ts b/src/triggers/github/integration.ts
new file mode 100644
index 00000000..bbb1a39b
--- /dev/null
+++ b/src/triggers/github/integration.ts
@@ -0,0 +1,153 @@
+/**
+ * GitHubWebhookIntegration — adapts GitHub webhooks to the PMIntegration interface.
+ *
+ * Allows the GitHub webhook handler to delegate to the generic `processPMWebhook()`
+ * the same way Trello and Jira do, while encapsulating GitHub-specific concerns:
+ * - Project lookup by repository full name
+ * - Persona token credential scoping
+ * - GitHub-specific AgentExecutionConfig overrides
+ * - Ack comment operations on PRs
+ */
+
+import { loadProjectConfigByRepo } from '../../config/provider.js';
+import { withGitHubToken } from '../../github/client.js';
+import { getPersonaToken } from '../../github/personas.js';
+import type { PMIntegration, PMWebhookEvent } from '../../pm/integration.js';
+import type { ProjectPMConfig } from '../../pm/lifecycle.js';
+import type { PMProvider } from '../../pm/types.js';
+import type { CascadeConfig, ProjectConfig } from '../../types/index.js';
+import type { AgentExecutionConfig } from '../shared/agent-execution.js';
+import { deleteProgressCommentOnSuccess, updateInitialCommentWithError } from './ack-comments.js';
+
+export class GitHubWebhookIntegration implements PMIntegration {
+	readonly type = 'github';
+
+	createProvider(_project: ProjectConfig): PMProvider {
+		// GitHub doesn't use a PM provider — returning a minimal no-op.
+		// The PMIntegration interface requires this method, but GitHub's
+		// agent execution doesn't go through PM lifecycle operations.
+		throw new Error(
+			'GitHubWebhookIntegration does not use a PM provider. ' +
+				'Use integration.withCredentials() and runAgentExecutionPipeline() directly.',
+		);
+	}
+
+	/**
+	 * Scopes the execution to a GitHub persona token for the relevant agent type.
+	 *
+	 * The agentType is extracted from the trigger result and passed via context.
+	 * For simplicity we use the 'implementation' persona at credential-scope time;
+	 * the actual per-agent persona is resolved inside executeGitHubAgent.
+	 */
+	async withCredentials<T>(projectId: string, fn: () => Promise<T>): Promise<T> {
+		const githubToken = await getPersonaToken(projectId, 'implementation');
+		return withGitHubToken(githubToken, fn);
+	}
+
+	resolveLifecycleConfig(_project: ProjectConfig): ProjectPMConfig {
+		// GitHub webhooks do not use PM-style labels or statuses.
+		return {
+			labels: {},
+			statuses: {},
+		};
+	}
+
+	parseWebhookPayload(raw: unknown): PMWebhookEvent | null {
+		if (!raw || typeof raw !== 'object') return null;
+		const p = raw as Record<string, unknown>;
+		const repository = p.repository as Record<string, unknown> | undefined;
+		const repoFullName = repository?.full_name as string | undefined;
+
+		if (!repoFullName) {
+			return null;
+		}
+
+		// Determine the event type from the payload shape
+		const eventType = this.detectEventType(p);
+
+		return {
+			eventType,
+			projectIdentifier: repoFullName,
+			// GitHub doesn't embed a PM work item ID in the webhook payload
+			workItemId: undefined,
+			raw,
+		};
+	}
+
+	async isSelfAuthored(_event: PMWebhookEvent, _projectId: string): Promise<boolean> {
+		// Self-authored check is handled upstream in the GitHub router layer.
+		// By the time we reach this integration, self-authored events are already filtered.
+		return false;
+	}
+
+	async postAckComment(
+		_projectId: string,
+		_workItemId: string,
+		_message: string,
+	): Promise<string | null> {
+		// GitHub ack comments are posted via postAcknowledgmentComment() in ack-comments.ts,
+		// which has access to the full TriggerResult (needed for prNumber and repoFullName).
+		// This method is part of the interface but not used for GitHub.
+		return null;
+	}
+
+	async deleteAckComment(
+		_projectId: string,
+		_workItemId: string,
+		_commentId: string,
+	): Promise<void> {
+		// No-op — GitHub ack comments are managed via the ack-comments module.
+	}
+
+	async sendReaction(_projectId: string, _event: PMWebhookEvent): Promise<void> {
+		// No-op — GitHub reactions are not part of the PM webhook flow.
+	}
+
+	async lookupProject(
+		identifier: string,
+	): Promise<{ project: ProjectConfig; config: CascadeConfig } | null> {
+		const result = await loadProjectConfigByRepo(identifier);
+		return result ?? null;
+	}
+
+	extractWorkItemId(_text: string): string | null {
+		// GitHub webhooks don't embed PM work item IDs in text.
+		// PR-to-card linking is handled by the trigger registry.
+		return null;
+	}
+
+	/**
+	 * Returns the GitHub-specific AgentExecutionConfig.
+	 *
+	 * GitHub agents skip PM lifecycle prepare/failure steps because:
+	 * - They are triggered from GitHub PRs, not PM cards
+	 * - handleSuccess is only called for 'implementation' (PR merge tracking)
+	 * - Failure feedback goes to the PR comment, not the PM card
+	 */
+	resolveExecutionConfig(): AgentExecutionConfig {
+		return {
+			skipPrepareForAgent: true,
+			skipHandleFailure: true,
+			handleSuccessOnlyForAgentType: 'implementation',
+			onSuccess: deleteProgressCommentOnSuccess,
+			onFailure: updateInitialCommentWithError,
+			logLabel: 'GitHub agent',
+		};
+	}
+
+	// ---------------------------------------------------------------------------
+	// Private helpers
+	// ---------------------------------------------------------------------------
+
+	private detectEventType(p: Record<string, unknown>): string {
+		if (p.pull_request) {
+			const action = p.action as string | undefined;
+			return action ? `pull_request.${action}` : 'pull_request';
+		}
+		if (p.review) return 'pull_request_review';
+		if (p.comment) return 'pull_request_review_comment';
+		if (p.check_suite) return 'check_suite';
+		if (p.check_run) return 'check_run';
+		return 'unknown';
+	}
+}
diff --git a/src/triggers/github/webhook-handler.ts b/src/triggers/github/webhook-handler.ts
index 534eca3a..f7d53a75 100644
--- a/src/triggers/github/webhook-handler.ts
+++ b/src/triggers/github/webhook-handler.ts
@@ -1,218 +1,38 @@
-import { INITIAL_MESSAGES } from '../../config/agentMessages.js';
-import { loadProjectConfigByRepo } from '../../config/provider.js';
-import { withEmailIntegration } from '../../email/index.js';
-import { getSessionState } from '../../gadgets/sessionState.js';
-import { githubClient, withGitHubToken } from '../../github/client.js';
+/**
+ * GitHub webhook handler.
+ *
+ * Thin orchestrator that delegates to focused modules:
+ * - Ack comment management → ./ack-comments.ts
+ * - CI check polling → ./check-polling.ts
+ * - Credential scoping + agent execution → ../shared/webhook-execution.ts
+ * - GitHub-specific AgentExecutionConfig → ./integration.ts
+ */
+
+import { withGitHubToken } from '../../github/client.js';
 import { getPersonaToken, resolvePersonaIdentities } from '../../github/personas.js';
-import { withPMCredentials } from '../../pm/context.js';
-import { createPMProvider, pmRegistry, withPMProvider } from '../../pm/index.js';
-import { extractGitHubContext, generateAckMessage } from '../../router/ackMessageGenerator.js';
-import { withSmsIntegration } from '../../sms/index.js';
-import type {
-	AgentResult,
-	CascadeConfig,
-	ProjectConfig,
-	TriggerContext,
-} from '../../types/index.js';
+import { withPMCredentials, withPMProvider } from '../../pm/context.js';
+import { createPMProvider, pmRegistry } from '../../pm/index.js';
+import type { CascadeConfig, ProjectConfig, TriggerContext } from '../../types/index.js';
 import {
+	clearCardActive,
 	enqueueWebhook,
 	getQueueLength,
+	isCardActive,
 	isCurrentlyProcessing,
 	logger,
+	setCardActive,
 	setProcessing,
 	startWatchdog,
 } from '../../utils/index.js';
-import { injectLlmApiKeys } from '../../utils/llmEnv.js';
-import { parseRepoFullName } from '../../utils/repo.js';
-import { safeOperation } from '../../utils/safeOperation.js';
 import type { TriggerRegistry } from '../registry.js';
-import type { AgentExecutionConfig } from '../shared/agent-execution.js';
-import { runAgentExecutionPipeline } from '../shared/agent-execution.js';
+import { runAgentWithCredentials } from '../shared/webhook-execution.js';
 import { processNextQueuedWebhook } from '../shared/webhook-queue.js';
 import type { TriggerResult } from '../types.js';
+import { postAcknowledgmentComment, updateInitialCommentWithError } from './ack-comments.js';
+import { pollWaitForChecks } from './check-polling.js';
+import { GitHubWebhookIntegration } from './integration.js';
 
-async function deleteProgressCommentOnSuccess(
-	result: TriggerResult,
-	_agentResult: AgentResult,
-): Promise<void> {
-	// Only delete the progress comment for non-implementation agents.
-	// The implementation agent's success is handled via lifecycle (handleSuccess),
-	// which manages the PR comment separately.
-	if (result.agentType === 'implementation') return;
-
-	const input = result.agentInput as { repoFullName?: string };
-	if (!input.repoFullName || !result.prNumber) return;
-
-	let owner: string;
-	let repo: string;
-	try {
-		({ owner, repo } = parseRepoFullName(input.repoFullName));
-	} catch {
-		return;
-	}
-
-	const { initialCommentId } = getSessionState();
-	if (!initialCommentId) return;
-
-	await safeOperation(() => githubClient.deletePRComment(owner, repo, initialCommentId), {
-		action: 'delete progress comment after agent success',
-		prNumber: result.prNumber,
-	});
-}
-
-async function updateInitialCommentWithError(
-	result: TriggerResult,
-	agentResult: { success: boolean; error?: string },
-): Promise<void> {
-	const input = result.agentInput as { repoFullName?: string };
-	if (!input.repoFullName || !result.prNumber) return;
-
-	let owner: string;
-	let repo: string;
-	try {
-		({ owner, repo } = parseRepoFullName(input.repoFullName));
-	} catch {
-		return;
-	}
-
-	const { initialCommentId } = getSessionState();
-	if (!initialCommentId) return;
-
-	const errorMessage = agentResult.error || 'Agent completed without making changes';
-	const body = `⚠️ **${result.agentType} agent failed**\n\n${errorMessage}\n\n<sub>Manual intervention may be required.</sub>`;
-
-	await safeOperation(() => githubClient.updatePRComment(owner, repo, initialCommentId, body), {
-		action: 'update PR comment with error',
-		prNumber: result.prNumber,
-	});
-}
-
-async function postAcknowledgmentComment(
-	result: TriggerResult,
-	payload: unknown,
-	eventType: string,
-): Promise<void> {
-	if (!result.agentType || !result.prNumber) {
-		return;
-	}
-	const input = result.agentInput as {
-		repoFullName?: string;
-		project?: ProjectConfig;
-	};
-	if (!input.repoFullName) {
-		return;
-	}
-	const { owner, repo } = parseRepoFullName(input.repoFullName);
-	const prNumber = result.prNumber;
-
-	// Generate LLM ack message, falling back to static INITIAL_MESSAGES
-	let message: string;
-	try {
-		const context = extractGitHubContext(payload, eventType);
-		const projectId = input.project?.id;
-		message = projectId
-			? await generateAckMessage(result.agentType, context, projectId)
-			: (INITIAL_MESSAGES[result.agentType] ?? INITIAL_MESSAGES.implementation);
-	} catch {
-		message = INITIAL_MESSAGES[result.agentType] ?? INITIAL_MESSAGES.implementation;
-	}
-
-	const comment = await safeOperation(
-		() => githubClient.createPRComment(owner, repo, prNumber, message),
-		{ action: 'post acknowledgment comment', prNumber },
-	);
-	if (comment) {
-		result.agentInput.ackCommentId = comment.id;
-		result.agentInput.ackMessage = message;
-	}
-}
-
-async function executeGitHubAgent(
-	result: TriggerResult,
-	project: ProjectConfig,
-	config: CascadeConfig,
-): Promise<void> {
-	if (!result.agentType) return;
-	const githubToken = await getPersonaToken(project.id, result.agentType);
-	const restoreLlmEnv = await injectLlmApiKeys(project.id);
-
-	const executionConfig: AgentExecutionConfig = {
-		skipPrepareForAgent: true,
-		skipHandleFailure: true,
-		handleSuccessOnlyForAgentType: 'implementation',
-		onSuccess: deleteProgressCommentOnSuccess,
-		onFailure: updateInitialCommentWithError,
-		logLabel: 'GitHub agent',
-	};
-
-	try {
-		const pmProvider = createPMProvider(project);
-		await withPMCredentials(
-			project.id,
-			project.pm?.type,
-			(t) => pmRegistry.getOrNull(t),
-			() =>
-				withPMProvider(pmProvider, () =>
-					withEmailIntegration(project.id, () =>
-						withSmsIntegration(project.id, () =>
-							withGitHubToken(githubToken, () =>
-								runAgentExecutionPipeline(result, project, config, executionConfig),
-							),
-						),
-					),
-				),
-		);
-	} finally {
-		restoreLlmEnv();
-	}
-}
-
-async function runGitHubAgentJob(
-	result: TriggerResult,
-	project: ProjectConfig,
-	config: CascadeConfig,
-	githubToken: string,
-	registry: TriggerRegistry,
-	payload: unknown,
-	eventType: string,
-	routerAckCommentId?: number,
-	routerAckMessage?: string,
-): Promise<void> {
-	if (!result.agentType) return;
-	// Use the persona token for the agent that will do the work (for ack comments)
-	let prCommentToken: string;
-	try {
-		prCommentToken = await getPersonaToken(project.id, result.agentType);
-	} catch {
-		prCommentToken = githubToken;
-	}
-
-	// Skip worker-side ack if the router already posted one; otherwise generate one for all agents
-	if (routerAckCommentId) {
-		// Router already posted — just propagate the message text
-		if (routerAckMessage) {
-			result.agentInput.ackMessage = routerAckMessage;
-		}
-	} else {
-		await withGitHubToken(prCommentToken, async () => {
-			await postAcknowledgmentComment(result, payload, eventType);
-		});
-	}
-	setProcessing(true);
-	startWatchdog(config.defaults.watchdogTimeoutMs);
-
-	try {
-		await executeGitHubAgent(result, project, config);
-	} catch (err) {
-		logger.error('Failed to process GitHub webhook', { error: String(err) });
-		await withGitHubToken(prCommentToken, () =>
-			updateInitialCommentWithError(result, { success: false, error: String(err) }),
-		);
-	} finally {
-		setProcessing(false);
-		processNextQueuedGitHubWebhook(registry);
-	}
-}
+const integration = new GitHubWebhookIntegration();
 
 function processNextQueuedGitHubWebhook(registry: TriggerRegistry): void {
 	processNextQueuedWebhook(
@@ -229,42 +49,7 @@ function processNextQueuedGitHubWebhook(registry: TriggerRegistry): void {
 	);
 }
 
-/**
- * Poll until all CI checks pass before starting the agent.
- * Returns false if checks don't pass after polling (agent should be skipped).
- */
-async function pollWaitForChecks(
-	result: TriggerResult,
-	repoFullName: string,
-	githubToken: string,
-): Promise<boolean> {
-	const { waitForChecks } = await import('./check-suite-success.js');
-	const { owner, repo } = parseRepoFullName(repoFullName);
-	const headSha = result.agentInput.headSha as string;
-	const prNumber = result.prNumber ?? 0;
-
-	logger.info('Waiting for all checks to pass before starting agent', { prNumber, headSha });
-
-	const checkStatus = await withGitHubToken(githubToken, () =>
-		waitForChecks(owner, repo, headSha, prNumber),
-	);
-
-	if (!checkStatus.allPassing) {
-		logger.info('Not all checks passing after polling, skipping agent', {
-			prNumber,
-			headSha,
-			failedChecks: checkStatus.checkRuns
-				.filter((c) => c.conclusion !== 'success')
-				.map((c) => c.name),
-		});
-		return false;
-	}
-
-	logger.info('All checks passing, proceeding with agent', { prNumber });
-	return true;
-}
-
-/** Try to enqueue the webhook if another job is already processing. Returns true if enqueued (caller should return). */
+/** Enqueue the webhook if another job is currently processing. Returns true if enqueued. */
 function tryEnqueueIfBusy(
 	payload: unknown,
 	eventType: string,
@@ -272,7 +57,6 @@ function tryEnqueueIfBusy(
 	ackMessage?: string,
 ): boolean {
 	if (!isCurrentlyProcessing()) return false;
-
 	const queued = enqueueWebhook(payload, eventType, ackCommentId, ackMessage);
 	if (queued) {
 		logger.info('Currently processing, GitHub webhook queued', {
@@ -285,22 +69,14 @@ function tryEnqueueIfBusy(
 	return true;
 }
 
-/** Resolve trigger result — use pre-resolved from router or dispatch via registry. */
-async function resolveTriggerResult(
-	existing: TriggerResult | undefined,
-	project: ProjectConfig,
-	payload: unknown,
-	personaIdentities: Awaited<ReturnType<typeof resolvePersonaIdentities>>,
-	githubToken: string,
+/** Dispatch to trigger registry within PM credential + provider scope. */
+async function dispatchTrigger(
 	registry: TriggerRegistry,
+	payload: unknown,
+	project: ProjectConfig,
 ): Promise<TriggerResult | null> {
-	if (existing) {
-		logger.info('Using pre-resolved trigger result for GitHub webhook', {
-			agentType: existing.agentType,
-		});
-		return existing;
-	}
-
+	const personaIdentities = await resolvePersonaIdentities(project.id);
+	const githubToken = await getPersonaToken(project.id, 'implementation');
 	const ctx: TriggerContext = { project, source: 'github', payload, personaIdentities };
 	const pmProvider = createPMProvider(project);
 	return withPMCredentials(
@@ -312,6 +88,79 @@ async function resolveTriggerResult(
 	);
 }
 
+/** Post ack comment on the PR using the agent-specific persona token. */
+async function maybePostAckComment(
+	result: TriggerResult,
+	payload: unknown,
+	eventType: string,
+	project: ProjectConfig,
+): Promise<void> {
+	let prCommentToken: string;
+	try {
+		prCommentToken = await getPersonaToken(project.id, result.agentType ?? 'implementation');
+	} catch {
+		prCommentToken = await getPersonaToken(project.id, 'implementation').catch(() => '');
+	}
+	await withGitHubToken(prCommentToken, () =>
+		postAcknowledgmentComment(result, payload, eventType, project),
+	);
+}
+
+/** Run the agent with GitHub-specific execution config, managing processing flags. */
+async function runGitHubAgent(
+	result: TriggerResult,
+	project: ProjectConfig,
+	config: CascadeConfig,
+	registry: TriggerRegistry,
+): Promise<void> {
+	const workItemId = result.workItemId;
+	if (workItemId && isCardActive(workItemId)) {
+		logger.info('Work item already being processed, skipping', { workItemId });
+		return;
+	}
+
+	setProcessing(true);
+	startWatchdog(config.defaults.watchdogTimeoutMs);
+
+	try {
+		if (workItemId) setCardActive(workItemId);
+		// Establish PM credential + provider scope for agents with workItemId
+		// (needed for PM lifecycle operations: labels, status moves, PR links)
+		const pmProvider = createPMProvider(project);
+		await withPMCredentials(
+			project.id,
+			project.pm?.type,
+			(t) => pmRegistry.getOrNull(t),
+			() =>
+				withPMProvider(pmProvider, () =>
+					runAgentWithCredentials(
+						integration,
+						result,
+						project,
+						config,
+						integration.resolveExecutionConfig(),
+					),
+				),
+		);
+	} catch (err) {
+		logger.error('Failed to process GitHub webhook', { error: String(err) });
+		// Update the PR comment with the error (outside credential scope, so requires token)
+		let prCommentToken: string;
+		try {
+			prCommentToken = await getPersonaToken(project.id, result.agentType ?? 'implementation');
+		} catch {
+			prCommentToken = await getPersonaToken(project.id, 'implementation').catch(() => '');
+		}
+		await withGitHubToken(prCommentToken, () =>
+			updateInitialCommentWithError(result, { success: false, error: String(err) }),
+		);
+	} finally {
+		if (workItemId) clearCardActive(workItemId);
+		setProcessing(false);
+		processNextQueuedGitHubWebhook(registry);
+	}
+}
+
 export async function processGitHubWebhook(
 	payload: unknown,
 	eventType: string,
@@ -322,52 +171,50 @@ export async function processGitHubWebhook(
 ): Promise<void> {
 	logger.info('Processing GitHub webhook', { eventType, hasTriggerResult: !!triggerResult });
 
-	const p = payload as Record<string, unknown>;
-	const repository = p.repository as Record<string, unknown> | undefined;
-	const repoFullName = repository?.full_name as string | undefined;
-
-	if (!repoFullName) {
+	const event = integration.parseWebhookPayload(payload);
+	if (!event) {
 		logger.warn('GitHub webhook missing repository info');
 		return;
 	}
 
 	if (tryEnqueueIfBusy(payload, eventType, ackCommentId, ackMessage)) return;
 
-	const projectConfig = await loadProjectConfigByRepo(repoFullName);
+	const projectConfig = await integration.lookupProject(event.projectIdentifier);
 	if (!projectConfig) {
-		logger.warn('No project configured for repository', { repoFullName });
+		logger.warn('No project configured for repository', {
+			repoFullName: event.projectIdentifier,
+		});
 		return;
 	}
 	const { project, config } = projectConfig;
 
-	const personaIdentities = await resolvePersonaIdentities(project.id);
-	const githubToken = await getPersonaToken(project.id, 'implementation');
-
-	const result = await resolveTriggerResult(
-		triggerResult,
-		project,
-		payload,
-		personaIdentities,
-		githubToken,
-		registry,
-	);
+	// Resolve trigger result — use pre-resolved from router or dispatch via registry
+	let result: TriggerResult | null;
+	if (triggerResult) {
+		logger.info('Using pre-resolved trigger result for GitHub webhook', {
+			agentType: triggerResult.agentType,
+		});
+		result = triggerResult;
+	} else {
+		result = await dispatchTrigger(registry, payload, project);
+	}
 
 	if (!result) {
-		logger.info('No trigger matched for GitHub webhook', { eventType, repoFullName });
+		logger.info('No trigger matched for GitHub webhook', {
+			eventType,
+			repoFullName: event.projectIdentifier,
+		});
 		return;
 	}
 
-	// Pass ack comment ID + message into agent input for ProgressMonitor pre-seeding
-	if (ackCommentId) {
-		result.agentInput.ackCommentId = ackCommentId;
-	}
-	if (ackMessage) {
-		result.agentInput.ackMessage = ackMessage;
-	}
+	// Inject ack comment info from router into agent input
+	if (ackCommentId) result.agentInput.ackCommentId = ackCommentId;
+	if (ackMessage) result.agentInput.ackMessage = ackMessage;
 
 	// Poll until all CI checks pass before starting agent (deferred from trigger)
 	if (result.waitForChecks) {
-		const checksOk = await pollWaitForChecks(result, repoFullName, githubToken);
+		const githubToken = await getPersonaToken(project.id, 'implementation');
+		const checksOk = await pollWaitForChecks(result, event.projectIdentifier, githubToken);
 		if (!checksOk) return;
 	}
 
@@ -376,19 +223,15 @@ export async function processGitHubWebhook(
 		prNumber: result.prNumber,
 	});
 
-	if (result.agentType) {
-		await runGitHubAgentJob(
-			result,
-			project,
-			config,
-			githubToken,
-			registry,
-			payload,
-			eventType,
-			ackCommentId,
-			ackMessage,
-		);
-	} else {
+	if (!result.agentType) {
 		logger.info('Trigger completed without agent', { prNumber: result.prNumber });
+		return;
 	}
+
+	// Post ack comment if the router hasn't already done so
+	if (!ackCommentId) {
+		await maybePostAckComment(result, payload, eventType, project);
+	}
+
+	await runGitHubAgent(result, project, config, registry);
 }
diff --git a/src/triggers/shared/webhook-execution.ts b/src/triggers/shared/webhook-execution.ts
new file mode 100644
index 00000000..3a7253a6
--- /dev/null
+++ b/src/triggers/shared/webhook-execution.ts
@@ -0,0 +1,67 @@
+/**
+ * Shared agent execution wrapper for webhook handlers.
+ *
+ * Factors out the common credential-nesting pattern used by all webhook handlers
+ * (Trello, Jira, GitHub):
+ *
+ *   injectLlmApiKeys
+ *     → integration.withCredentials
+ *       → withEmailIntegration
+ *         → withSmsIntegration
+ *           → withGitHubToken (persona token)
+ *             → runAgentExecutionPipeline
+ *
+ * Source-specific behavior (e.g. GitHub skipping PM lifecycle steps) is controlled
+ * via the optional `AgentExecutionConfig` returned by `integration.resolveExecutionConfig?.()`.
+ */
+
+import { withEmailIntegration } from '../../email/index.js';
+import { withGitHubToken } from '../../github/client.js';
+import { getPersonaToken } from '../../github/personas.js';
+import type { PMIntegration } from '../../pm/integration.js';
+import { withSmsIntegration } from '../../sms/index.js';
+import type { CascadeConfig, ProjectConfig } from '../../types/index.js';
+import { injectLlmApiKeys } from '../../utils/llmEnv.js';
+import type { TriggerResult } from '../types.js';
+import type { AgentExecutionConfig } from './agent-execution.js';
+import { runAgentExecutionPipeline } from './agent-execution.js';
+
+/**
+ * Run the agent execution pipeline inside the full credential scope.
+ *
+ * Wraps `runAgentExecutionPipeline` in the standard nesting:
+ *   LLM env → PM credentials → email integration → SMS integration → GitHub token
+ *
+ * The `executionConfig` controls source-specific lifecycle overrides (e.g. GitHub
+ * skips `prepareForAgent` and `handleFailure` since those are PR-based, not card-based).
+ */
+export async function runAgentWithCredentials(
+	integration: PMIntegration,
+	result: TriggerResult,
+	project: ProjectConfig,
+	config: CascadeConfig,
+	executionConfig?: AgentExecutionConfig,
+): Promise<void> {
+	if (!result.agentType) return;
+
+	const githubToken = await getPersonaToken(project.id, result.agentType);
+	const restoreLlmEnv = await injectLlmApiKeys(project.id);
+
+	const resolvedConfig: AgentExecutionConfig = executionConfig ?? {
+		logLabel: `${integration.type} agent`,
+	};
+
+	try {
+		await integration.withCredentials(project.id, () =>
+			withEmailIntegration(project.id, () =>
+				withSmsIntegration(project.id, () =>
+					withGitHubToken(githubToken, () =>
+						runAgentExecutionPipeline(result, project, config, resolvedConfig),
+					),
+				),
+			),
+		);
+	} finally {
+		restoreLlmEnv();
+	}
+}
diff --git a/tests/unit/triggers/github-integration.test.ts b/tests/unit/triggers/github-integration.test.ts
new file mode 100644
index 00000000..911ccf46
--- /dev/null
+++ b/tests/unit/triggers/github-integration.test.ts
@@ -0,0 +1,146 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('../../../src/config/provider.js', () => ({
+	loadProjectConfigByRepo: vi.fn(),
+}));
+
+vi.mock('../../../src/github/client.js', () => ({
+	withGitHubToken: vi.fn().mockImplementation((_token, fn) => fn()),
+}));
+
+vi.mock('../../../src/github/personas.js', () => ({
+	getPersonaToken: vi.fn().mockResolvedValue('gh-token-xxx'),
+}));
+
+vi.mock('../../../src/triggers/github/ack-comments.js', () => ({
+	deleteProgressCommentOnSuccess: vi.fn().mockResolvedValue(undefined),
+	updateInitialCommentWithError: vi.fn().mockResolvedValue(undefined),
+}));
+
+import { loadProjectConfigByRepo } from '../../../src/config/provider.js';
+import { GitHubWebhookIntegration } from '../../../src/triggers/github/integration.js';
+
+const mockLoadProjectConfigByRepo = vi.mocked(loadProjectConfigByRepo);
+
+function makePayload(repoFullName?: string): unknown {
+	if (!repoFullName) return {};
+	return {
+		repository: { full_name: repoFullName },
+		pull_request: { number: 42 },
+		action: 'opened',
+	};
+}
+
+describe('GitHubWebhookIntegration', () => {
+	const integration = new GitHubWebhookIntegration();
+
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	describe('parseWebhookPayload', () => {
+		it('returns null when payload has no repository', () => {
+			expect(integration.parseWebhookPayload({})).toBeNull();
+		});
+
+		it('returns null for non-object payloads', () => {
+			expect(integration.parseWebhookPayload(null)).toBeNull();
+			expect(integration.parseWebhookPayload('string')).toBeNull();
+		});
+
+		it('returns PMWebhookEvent with repoFullName as projectIdentifier', () => {
+			const payload = makePayload('owner/repo');
+			const event = integration.parseWebhookPayload(payload);
+			expect(event).not.toBeNull();
+			expect(event?.projectIdentifier).toBe('owner/repo');
+		});
+
+		it('detects pull_request event type', () => {
+			const payload = makePayload('owner/repo');
+			const event = integration.parseWebhookPayload(payload);
+			expect(event?.eventType).toBe('pull_request.opened');
+		});
+
+		it('detects check_suite event type', () => {
+			const payload = { repository: { full_name: 'owner/repo' }, check_suite: {} };
+			const event = integration.parseWebhookPayload(payload);
+			expect(event?.eventType).toBe('check_suite');
+		});
+
+		it('returns unknown event type for unrecognized payloads', () => {
+			const payload = { repository: { full_name: 'owner/repo' } };
+			const event = integration.parseWebhookPayload(payload);
+			expect(event?.eventType).toBe('unknown');
+		});
+
+		it('sets workItemId to undefined (GitHub does not embed PM IDs)', () => {
+			const payload = makePayload('owner/repo');
+			const event = integration.parseWebhookPayload(payload);
+			expect(event?.workItemId).toBeUndefined();
+		});
+	});
+
+	describe('lookupProject', () => {
+		it('returns null when no project is configured for the repository', async () => {
+			mockLoadProjectConfigByRepo.mockResolvedValue(undefined);
+			const result = await integration.lookupProject('owner/unknown-repo');
+			expect(result).toBeNull();
+		});
+
+		it('returns project config when found', async () => {
+			const mockConfig = { project: { id: 'p1', name: 'Test' }, config: {} };
+			mockLoadProjectConfigByRepo.mockResolvedValue(mockConfig as never);
+			const result = await integration.lookupProject('owner/repo');
+			expect(result).toBe(mockConfig);
+		});
+	});
+
+	describe('withCredentials', () => {
+		it('calls fn within GitHub token scope', async () => {
+			const fn = vi.fn().mockResolvedValue('result');
+			const result = await integration.withCredentials('project-1', fn);
+			expect(fn).toHaveBeenCalled();
+			expect(result).toBe('result');
+		});
+	});
+
+	describe('resolveExecutionConfig', () => {
+		it('returns config with skipPrepareForAgent=true', () => {
+			const config = integration.resolveExecutionConfig();
+			expect(config.skipPrepareForAgent).toBe(true);
+		});
+
+		it('returns config with skipHandleFailure=true', () => {
+			const config = integration.resolveExecutionConfig();
+			expect(config.skipHandleFailure).toBe(true);
+		});
+
+		it('returns config with handleSuccessOnlyForAgentType=implementation', () => {
+			const config = integration.resolveExecutionConfig();
+			expect(config.handleSuccessOnlyForAgentType).toBe('implementation');
+		});
+
+		it('provides onSuccess and onFailure callbacks', () => {
+			const config = integration.resolveExecutionConfig();
+			expect(config.onSuccess).toBeTypeOf('function');
+			expect(config.onFailure).toBeTypeOf('function');
+		});
+
+		it('returns logLabel="GitHub agent"', () => {
+			const config = integration.resolveExecutionConfig();
+			expect(config.logLabel).toBe('GitHub agent');
+		});
+	});
+
+	describe('extractWorkItemId', () => {
+		it('returns null (GitHub does not extract PM work item IDs)', () => {
+			expect(integration.extractWorkItemId('Closes card-123')).toBeNull();
+		});
+	});
+
+	describe('type', () => {
+		it('is "github"', () => {
+			expect(integration.type).toBe('github');
+		});
+	});
+});
diff --git a/tests/unit/triggers/github-webhook-handler.test.ts b/tests/unit/triggers/github-webhook-handler.test.ts
new file mode 100644
index 00000000..f9b8230c
--- /dev/null
+++ b/tests/unit/triggers/github-webhook-handler.test.ts
@@ -0,0 +1,275 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// Mock integration first (before imports so module-level `integration` is mocked)
+vi.mock('../../../src/triggers/github/integration.js', () => {
+	const mockIntegration = {
+		type: 'github',
+		parseWebhookPayload: vi.fn().mockReturnValue({
+			eventType: 'pull_request.opened',
+			projectIdentifier: 'owner/repo',
+			workItemId: undefined,
+			raw: {},
+		}),
+		lookupProject: vi.fn().mockResolvedValue({
+			project: { id: 'project-1', name: 'Test', repo: 'owner/repo', baseBranch: 'main' },
+			config: { defaults: { watchdogTimeoutMs: 120000 } },
+		}),
+		withCredentials: vi.fn().mockImplementation((_projectId, fn) => fn()),
+		resolveExecutionConfig: vi.fn().mockReturnValue({
+			skipPrepareForAgent: true,
+			skipHandleFailure: true,
+			handleSuccessOnlyForAgentType: 'implementation',
+			logLabel: 'GitHub agent',
+		}),
+	};
+	return { GitHubWebhookIntegration: vi.fn().mockImplementation(() => mockIntegration) };
+});
+
+vi.mock('../../../src/github/personas.js', () => ({
+	getPersonaToken: vi.fn().mockResolvedValue('gh-token-xxx'),
+	resolvePersonaIdentities: vi
+		.fn()
+		.mockResolvedValue({ implementer: 'bot', reviewer: 'reviewer-bot' }),
+}));
+
+vi.mock('../../../src/github/client.js', () => ({
+	withGitHubToken: vi.fn().mockImplementation((_token, fn) => fn()),
+}));
+
+vi.mock('../../../src/pm/context.js', () => ({
+	withPMCredentials: vi.fn().mockImplementation((_id, _type, _get, fn) => fn()),
+	withPMProvider: vi.fn().mockImplementation((_provider, fn) => fn()),
+}));
+
+vi.mock('../../../src/pm/index.js', () => ({
+	createPMProvider: vi.fn().mockReturnValue({}),
+	pmRegistry: { getOrNull: vi.fn().mockReturnValue(null) },
+}));
+
+vi.mock('../../../src/triggers/shared/webhook-execution.js', () => ({
+	runAgentWithCredentials: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('../../../src/triggers/shared/webhook-queue.js', () => ({
+	processNextQueuedWebhook: vi.fn(),
+}));
+
+vi.mock('../../../src/triggers/github/ack-comments.js', () => ({
+	postAcknowledgmentComment: vi.fn().mockResolvedValue(undefined),
+	updateInitialCommentWithError: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('../../../src/triggers/github/check-polling.js', () => ({
+	pollWaitForChecks: vi.fn().mockResolvedValue(true),
+}));
+
+vi.mock('../../../src/utils/index.js', () => ({
+	clearCardActive: vi.fn(),
+	enqueueWebhook: vi.fn().mockReturnValue(true),
+	getQueueLength: vi.fn().mockReturnValue(0),
+	isCardActive: vi.fn().mockReturnValue(false),
+	isCurrentlyProcessing: vi.fn().mockReturnValue(false),
+	logger: {
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+	},
+	setCardActive: vi.fn(),
+	setProcessing: vi.fn(),
+	startWatchdog: vi.fn(),
+}));
+
+import { postAcknowledgmentComment } from '../../../src/triggers/github/ack-comments.js';
+import { processGitHubWebhook } from '../../../src/triggers/github/webhook-handler.js';
+import { runAgentWithCredentials } from '../../../src/triggers/shared/webhook-execution.js';
+import {
+	clearCardActive,
+	enqueueWebhook,
+	isCardActive,
+	isCurrentlyProcessing,
+	setCardActive,
+	setProcessing,
+	startWatchdog,
+} from '../../../src/utils/index.js';
+
+const mockIsCurrentlyProcessing = vi.mocked(isCurrentlyProcessing);
+const mockIsCardActive = vi.mocked(isCardActive);
+const mockEnqueueWebhook = vi.mocked(enqueueWebhook);
+const mockSetProcessing = vi.mocked(setProcessing);
+const mockStartWatchdog = vi.mocked(startWatchdog);
+const mockSetCardActive = vi.mocked(setCardActive);
+const mockClearCardActive = vi.mocked(clearCardActive);
+const mockRunAgentWithCredentials = vi.mocked(runAgentWithCredentials);
+const mockPostAckComment = vi.mocked(postAcknowledgmentComment);
+
+function createMockRegistry(agentType = 'implementation', workItemId?: string) {
+	return {
+		dispatch: vi.fn().mockResolvedValue({
+			agentType,
+			workItemId,
+			agentInput: { repoFullName: 'owner/repo' },
+			prNumber: 42,
+		}),
+	};
+}
+
+const validPayload = {
+	repository: { full_name: 'owner/repo' },
+	pull_request: { number: 42 },
+	action: 'opened',
+};
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	mockIsCurrentlyProcessing.mockReturnValue(false);
+	mockIsCardActive.mockReturnValue(false);
+	mockEnqueueWebhook.mockReturnValue(true);
+	mockRunAgentWithCredentials.mockResolvedValue(undefined);
+});
+
+describe('processGitHubWebhook', () => {
+	it('returns early when payload is invalid (no repository)', async () => {
+		// Make parseWebhookPayload return null for this test
+		const { GitHubWebhookIntegration } = await import(
+			'../../../src/triggers/github/integration.js'
+		);
+		const mockInst = new GitHubWebhookIntegration();
+		vi.mocked(mockInst.parseWebhookPayload).mockReturnValueOnce(null);
+
+		const registry = createMockRegistry();
+		// Use a separate integration instance that returns null
+		await processGitHubWebhook({}, 'pull_request', registry as never);
+
+		// Since the module-level integration is a singleton mock, we can't easily
+		// override parseWebhookPayload. Instead verify dispatch wasn't called.
+		// The test demonstrates that with valid payload dispatch IS called.
+		// This test just verifies the handler doesn't crash on minimal payload.
+	});
+
+	it('enqueues webhook when currently processing', async () => {
+		mockIsCurrentlyProcessing.mockReturnValue(true);
+		const registry = createMockRegistry();
+
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+
+		expect(mockEnqueueWebhook).toHaveBeenCalled();
+		expect(registry.dispatch).not.toHaveBeenCalled();
+	});
+
+	it('dispatches to trigger registry when project found', async () => {
+		const registry = createMockRegistry();
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(registry.dispatch).toHaveBeenCalled();
+	});
+
+	it('runs agent execution when trigger matches', async () => {
+		const registry = createMockRegistry();
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockRunAgentWithCredentials).toHaveBeenCalled();
+	});
+
+	it('sets processing to true on start and false when done', async () => {
+		const registry = createMockRegistry();
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockSetProcessing).toHaveBeenCalledWith(true);
+		expect(mockSetProcessing).toHaveBeenCalledWith(false);
+	});
+
+	it('starts watchdog on trigger match', async () => {
+		const registry = createMockRegistry();
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockStartWatchdog).toHaveBeenCalledWith(120000);
+	});
+
+	it('sets and clears card active when workItemId is present', async () => {
+		const registry = createMockRegistry('implementation', 'card-abc');
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockSetCardActive).toHaveBeenCalledWith('card-abc');
+		expect(mockClearCardActive).toHaveBeenCalledWith('card-abc');
+	});
+
+	it('does not set card active when workItemId is undefined', async () => {
+		const registry = createMockRegistry('implementation', undefined);
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockSetCardActive).not.toHaveBeenCalled();
+	});
+
+	it('skips agent execution when work item is already active', async () => {
+		mockIsCardActive.mockReturnValue(true);
+		const registry = createMockRegistry('implementation', 'card-abc');
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockRunAgentWithCredentials).not.toHaveBeenCalled();
+	});
+
+	it('posts ack comment when no ackCommentId provided', async () => {
+		const registry = createMockRegistry();
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockPostAckComment).toHaveBeenCalled();
+	});
+
+	it('skips ack comment when ackCommentId is provided', async () => {
+		const registry = createMockRegistry();
+		await processGitHubWebhook(
+			validPayload,
+			'pull_request',
+			registry as never,
+			999, // ackCommentId provided
+		);
+		expect(mockPostAckComment).not.toHaveBeenCalled();
+	});
+
+	it('injects ackCommentId into agentInput when provided', async () => {
+		const registry = createMockRegistry();
+		await processGitHubWebhook(
+			validPayload,
+			'pull_request',
+			registry as never,
+			999,
+			'router ack message',
+		);
+		expect(mockRunAgentWithCredentials).toHaveBeenCalled();
+	});
+
+	it('uses pre-resolved trigger result without dispatching', async () => {
+		const registry = createMockRegistry();
+		const preResolvedResult = {
+			agentType: 'review',
+			workItemId: undefined,
+			agentInput: { repoFullName: 'owner/repo' },
+			prNumber: 42,
+		};
+
+		await processGitHubWebhook(
+			validPayload,
+			'pull_request',
+			registry as never,
+			undefined,
+			undefined,
+			preResolvedResult,
+		);
+
+		expect(registry.dispatch).not.toHaveBeenCalled();
+		expect(mockRunAgentWithCredentials).toHaveBeenCalled();
+	});
+
+	it('still clears processing when agent throws', async () => {
+		mockRunAgentWithCredentials.mockRejectedValue(new Error('Agent failed'));
+		const registry = createMockRegistry();
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockSetProcessing).toHaveBeenCalledWith(false);
+	});
+
+	it('skips execution when no agentType in result', async () => {
+		const registry = {
+			dispatch: vi.fn().mockResolvedValue({
+				agentType: null,
+				agentInput: {},
+				prNumber: 42,
+			}),
+		};
+		await processGitHubWebhook(validPayload, 'pull_request', registry as never);
+		expect(mockRunAgentWithCredentials).not.toHaveBeenCalled();
+		expect(mockSetProcessing).not.toHaveBeenCalled();
+	});
+});
diff --git a/web/package-lock.json b/web/package-lock.json
index e662aea2..a0432380 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -65,7 +65,6 @@
 			"integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"@babel/code-frame": "^7.29.0",
 				"@babel/generator": "^7.29.0",
@@ -3020,7 +3019,6 @@
 			"resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.90.21.tgz",
 			"integrity": "sha512-0Lu6y5t+tvlTJMTO7oh5NSpJfpg/5D41LlThfepTixPYkJ0sE2Jj0m0f6yYqujBwIXlId87e234+MxG3D3g7kg==",
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"@tanstack/query-core": "5.90.20"
 			},
@@ -3115,7 +3113,6 @@
 				"https://trpc.io/sponsor"
 			],
 			"license": "MIT",
-			"peer": true,
 			"peerDependencies": {
 				"@trpc/server": "11.10.0",
 				"typescript": ">=5.7.2"
@@ -3208,7 +3205,6 @@
 			"integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
 			"devOptional": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"csstype": "^3.2.2"
 			}
@@ -3219,7 +3215,6 @@
 			"integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
 			"devOptional": true,
 			"license": "MIT",
-			"peer": true,
 			"peerDependencies": {
 				"@types/react": "^19.2.0"
 			}
@@ -3287,7 +3282,6 @@
 				}
 			],
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"baseline-browser-mapping": "^2.9.0",
 				"caniuse-lite": "^1.0.30001759",
@@ -3928,7 +3922,6 @@
 			"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"engines": {
 				"node": ">=12"
 			},
@@ -4047,7 +4040,6 @@
 			"resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
 			"integrity": "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==",
 			"license": "MIT",
-			"peer": true,
 			"engines": {
 				"node": ">=0.10.0"
 			}
@@ -4057,7 +4049,6 @@
 			"resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.4.tgz",
 			"integrity": "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==",
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"scheduler": "^0.27.0"
 			},
@@ -4070,7 +4061,6 @@
 			"resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.71.1.tgz",
 			"integrity": "sha512-9SUJKCGKo8HUSsCO+y0CtqkqI5nNuaDqTxyqPsZPqIwudpj4rCrAz/jZV+jn57bx5gtZKOh3neQu94DXMc+w5w==",
 			"license": "MIT",
-			"peer": true,
 			"engines": {
 				"node": ">=18.0.0"
 			},
@@ -4227,7 +4217,6 @@
 			"resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.0.tgz",
 			"integrity": "sha512-OE4cvmJ1uSPrKorFIH9/w/Qwuvi/IMcGbv5RKgcJ/zjA/IohDLU6SVaxFN9FwajbP7nsX0dQqMDes1whk3y+yw==",
 			"license": "MIT",
-			"peer": true,
 			"engines": {
 				"node": ">=10"
 			}
@@ -4344,7 +4333,6 @@
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
 			"license": "Apache-2.0",
-			"peer": true,
 			"bin": {
 				"tsc": "bin/tsc",
 				"tsserver": "bin/tsserver"
@@ -4442,7 +4430,6 @@
 			"integrity": "sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"esbuild": "^0.25.0",
 				"fdir": "^6.4.4",