@1aboveio/skills 0.19.0 → 0.19.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1aboveio/skills",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Install the 1AboveIO first-party skill groups through the native Skills CLI.",
   "license": "MIT",
   "type": "module",

package/runtime/skills/distribution/generated/recipes.json

@@ -8,7 +8,7 @@
       "id": "first-party",
       "type": "first-party",
       "package": "@1aboveio/skills",
-      "version": "0.19.0",
+      "version": "0.19.2",
       "updatePolicy": "pinned-npm-version",
       "members": [
         {
@@ -208,7 +208,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -244,7 +244,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -290,7 +290,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -323,7 +323,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -366,7 +366,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -394,7 +394,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -432,7 +432,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -460,7 +460,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -498,7 +498,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -526,7 +526,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -564,7 +564,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -596,7 +596,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -636,7 +636,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime"
@@ -662,7 +662,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.19.0",
+            "version": "0.19.2",
             "installPath": null,
             "members": [
               "harness-runtime"
@@ -694,7 +694,7 @@
           "sourceId": "first-party",
           "sourceType": "first-party",
           "package": "@1aboveio/skills",
-          "version": "0.19.0",
+          "version": "0.19.2",
           "installPath": null,
           "members": [
             "harness-runtime",
@@ -749,7 +749,7 @@
           "sourceId": "first-party",
           "sourceType": "first-party",
           "package": "@1aboveio/skills",
-          "version": "0.19.0",
+          "version": "0.19.2",
           "installPath": null,
           "members": [
             "harness-runtime",

package/runtime/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -119,7 +119,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.19.0',
+    version: '0.19.2',
   },
   matt: {
     id: 'matt-pocock',

package/skills/cicd-pipeline/mergify/references/watch-contract.md

@@ -20,12 +20,17 @@ The identical observation means opposite things on either side of queue entry:
 |---|---|---|
 | active queue membership absent | `NOT_YET_QUEUED` — healthy, keep waiting | **`DEQUEUED`** — terminal, read the reason |
 
-So the watcher's memory *is* the verdict. Four pieces of state must survive across polls:
+So the watcher's memory *is* the verdict. Five pieces of state must survive across polls:
 
 1. **`seenQueued`** — has queue entry ever been observed? Every downstream transition depends on it. Set from the `queued` label **or** `mergify queue show`.
 2. **A re-read counter** (`missingActiveReads` / `absentStreak`) — one absence is suspicion, two consecutive *readable* absences settle `DEQUEUED`.
 3. **Readable vs. absent** — a failed `gh`/`mergify` call is *no information*: it must not advance that counter or overwrite that source's last readable contribution to the stall-state snapshot. During a partial outage, the still-readable sibling remains informative and genuine progress from it still resets the change clock.
 4. **A change clock** (`lastChangeMs`) — the stall bound is *no observable change*, not elapsed time.
+5. **The last synthetic batch PR number** — retain
+   `mergeability_check.queue_pull_request_number` from every readable active queue
+   observation (and accept the older top-level spelling). Mergify removes that relationship
+   from `queue show` after dequeue, but the terminal reason belongs to the synthetic batch,
+   not the original PR.
 
 ### Why a per-poll predicate cannot satisfy this
 
@@ -149,14 +154,24 @@ Suggested routing classes:
 
 | raw reason shape | route |
 |---|---|
-| `checks-failed` | fix round, fresh verdict, new enqueue |
+| batch check `FAILURE`, `ERROR`, or `TIMED_OUT` | `checks-failed`; fix round, fresh verdict, new enqueue |
+| batch checks cancelled before validation executes | `checks-cancelled`; report the cancelled checks and hand back so an unchanged-SHA requeue can be considered |
 | `pull-request-updated`, `draft-pull-request-changed` | HEAD moved; verdict stale; re-enter delivery after fresh validation |
 | `conflict`, `conflict-with-base-branch` | rebase/evidence refresh, then enqueue |
 | `conditions-unmet`, `frozen`, `manual`, `pr-manually-dequeued`, `checks-timeout` | hand back with the condition/reason quoted |
-| unknown | hand back; fail closed |
+| unknown | `unknown`; hand back, fail closed, and preserve `rawReason` |
 
 When the reason is not machine-readable, quote the Mergify status comment, queue show condition leaf, or event-log URL in `rawReason` rather than inventing a reason.
 
+The selected `state:"dequeued"` Mergify status comment is parsed as structured evidence:
+`dequeuedAtMs`, `rawReason`, its draft PR fallback, and provider-reported failing checks. On
+dequeue, the watcher queries the retained batch PR once and attaches its failed or cancelled
+`statusCheckRollup` entries to the terminal verdict. A missing or deleted batch PR remains a
+truthful `DEQUEUED`: `batchPr.readable` is false, the retained number and `rawReason` survive,
+and any checks named by the provider comment remain available. An unchanged-SHA requeue can
+produce a new synthetic PR; every readable active observation replaces the retained number,
+so the newest batch wins over stale comment fallback.
+
 ## Watcher Requirements
 
 - Run as one background task or one script invocation; do not spend foreground turns polling.
@@ -195,13 +210,16 @@ Output streams:
 | stdout | exactly one pretty-printed terminal JSON verdict, at exit — carrying `phases`, `seenQueued`, and the outcome |
 | stderr | one compact JSON record per poll (`progress: true`), with the live outcome, PR labels, queue membership/position, `phases`, `changed`, and `sinceChangeMs` — the stall clock made visible |
 
-Each subprocess read (`gh pr view`, `mergify queue show`) also carries its own bounded
+Each regular-poll subprocess read (`gh pr view`, `mergify queue show`) also carries its own bounded
 timeout — a small multiple of `--interval-seconds`, clamped to never exceed the **effective
 phase stall bound** (pre-admission: `--admission-stall-minutes`; post-entry: `--stall-minutes`)
 capped by `--max-minutes`, then divided by the number of reads made per poll (2 here:
 `gh pr view` + `mergify queue show`). The two reads together cannot outlive the bound that will
 actually fire `STALLED` on this poll — so a hung pre-admission poll cannot outlive the short
 admission clock, and a post-entry poll is not permanently clamped to the admission value.
+After a terminal dequeue classification, one additional bounded `gh pr view` reads the
+retained synthetic batch PR. It enriches the already-settled verdict and never participates
+in queue membership, the absence counter, or the stall clock.
 Those stall/ceiling bounds are only evaluated after a poll returns, and a single hung read
 cannot alone consume more than half of a small stall/ceiling bound. (The sibling watcher makes
 one read per poll, so its clamp divides by 1 and the single-read guarantee is the whole bound

package/skills/cicd-pipeline/mergify/scripts/watch-pr-delivery-core.mjs

@@ -162,6 +162,7 @@ export function observationKey({ pr = {}, queue = {} } = {}) {
     queue.queued ?? null,
     queue.queueState ?? queue.state ?? null,
     queue.position ?? null,
+    queue.batchPrNumber ?? null,
   ])
 }
 
@@ -181,6 +182,7 @@ function stallQueueSnapshot(queue = {}) {
     queued: queue.queued ?? null,
     queueState: queue.queueState ?? queue.state ?? null,
     position: queue.position ?? null,
+    batchPrNumber: queue.batchPrNumber ?? null,
   }
 }
 
@@ -413,13 +415,16 @@ export function summarizeStatusChecks(rollup) {
 // (`startedMs`) — a locally-slow clock could in principle make a stale dequeue read as fresh;
 // low risk on an NTP-synced host, called out here rather than silently assumed away (NOTE-2).
 //
-// Returns epoch milliseconds, or null when no mergify comment's payload reports
-// `state: "dequeued"`, or that comment has no parseable "Left the queue" line — callers must
-// treat null as "no reliable timestamp", never as "not dequeued".
+// Parse the selected dequeue comment once and retain all provider evidence used by the
+// terminal verdict. The rendered comment is also the only surviving source after Mergify's
+// queue API drops active membership and its synthetic PR relationship.
 const MERGIFY_PAYLOAD_RE = /-\*- Mergify Payload -\*-\s*\n(\{[\s\S]*?\})\s*\n-\*- Mergify Payload End -\*-/
 const LEFT_QUEUE_RE = /Left the queue\*\*[^`\n]*`(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}) UTC`/g
+const BATCH_PR_RE = /\bon draft #(\d+)\b/i
+const REASON_RE = /^## Reason\s*\n+([^\n]+)/m
+const PROVIDER_CHECK_RE = /^-\s*(❌|🟠|🛑)\s*\[([^\]]+)\]\(([^)]+)\)/gmu
 
-export function dequeuedAtFromComments(comments) {
+export function dequeueInfoFromComments(comments) {
   const list = Array.isArray(comments) ? comments : []
   const mergifyComments = list.filter((c) => c && c.author && c.author.login === 'mergify')
   let target = null
@@ -431,15 +436,36 @@ export function dequeuedAtFromComments(comments) {
     try { payload = JSON.parse(payloadMatch[1]) } catch { continue }
     if (payload && payload.state === 'dequeued') target = comment // last match wins — comments are chronological
   }
-  if (!target) return null
+  if (!target) return { dequeuedAtMs: null, rawReason: null, batchPrNumber: null, providerFailedChecks: [] }
   const body = typeof target.body === 'string' ? target.body : ''
   let match
   let last = null
   LEFT_QUEUE_RE.lastIndex = 0
   while ((match = LEFT_QUEUE_RE.exec(body))) last = match
-  if (!last) return null
-  const [, y, mo, d, h, mi] = last
-  return Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi))
+  const dequeuedAtMs = last
+    ? Date.UTC(Number(last[1]), Number(last[2]) - 1, Number(last[3]), Number(last[4]), Number(last[5]))
+    : null
+  const reasonMatch = REASON_RE.exec(body)
+  const batchMatch = BATCH_PR_RE.exec(body)
+  const providerFailedChecks = []
+  PROVIDER_CHECK_RE.lastIndex = 0
+  while ((match = PROVIDER_CHECK_RE.exec(body))) {
+    providerFailedChecks.push({
+      name: match[2],
+      status: match[1] === '🟠' ? 'CANCELLED' : (match[1] === '🛑' ? 'TIMED_OUT' : 'FAILURE'),
+      detailsUrl: match[3] || null,
+    })
+  }
+  return {
+    dequeuedAtMs,
+    rawReason: reasonMatch?.[1]?.trim() || null,
+    batchPrNumber: batchMatch ? Number(batchMatch[1]) : null,
+    providerFailedChecks,
+  }
+}
+
+export function dequeuedAtFromComments(comments) {
+  return dequeueInfoFromComments(comments).dequeuedAtMs
 }
 
 // Exported so tests can pin that the live read timeout uses the same phase-aware bound the
@@ -470,6 +496,7 @@ function prObservation({ repo, pr, intervalSeconds, stallMinutes, admissionStall
   const data = parseJson(result.stdout)
   if (!data) return { readable: false, error: 'gh pr view returned invalid JSON' }
   const checks = summarizeStatusChecks(data.statusCheckRollup)
+  const dequeueInfo = dequeueInfoFromComments(data.comments)
   return {
     readable: true,
     state: data.state || null,
@@ -478,7 +505,8 @@ function prObservation({ repo, pr, intervalSeconds, stallMinutes, admissionStall
     headRefOid: data.headRefOid || null,
     labels: (data.labels || []).map((label) => label.name).filter(Boolean),
     url: data.url || null,
-    dequeuedAtMs: dequeuedAtFromComments(data.comments),
+    dequeuedAtMs: dequeueInfo.dequeuedAtMs,
+    dequeueInfo,
     ...checks,
   }
 }
@@ -514,12 +542,46 @@ export function queueObservation({ pr, repo, intervalSeconds, stallMinutes, admi
       queued: parsed.queued === true || Boolean(parsed.queue_rule_name || parsed.queue_rule),
       queueState: parsed.status || parsed.state || parsed.mergeability_check?.state || null,
       position: typeof parsed.position === 'number' ? parsed.position : null,
+      batchPrNumber: positivePrNumber(
+        parsed.mergeability_check?.queue_pull_request_number
+          ?? parsed.queue_pull_request_number
+          ?? parsed.speculative_check_pr,
+      ),
       raw: parsed,
     }
   }
   const text = `${result.stdout}\n${result.stderr}`.trim()
-  if (/not in the merge queue|not queued|not found/i.test(text)) return { readable: true, queued: false, queueState: 'not-queued', position: null, raw: text }
-  return { readable: false, queued: false, queueState: null, position: null, raw: text || 'mergify queue show failed' }
+  if (/not in the merge queue|not queued|not found/i.test(text)) return { readable: true, queued: false, queueState: 'not-queued', position: null, batchPrNumber: null, raw: text }
+  return { readable: false, queued: false, queueState: null, position: null, batchPrNumber: null, raw: text || 'mergify queue show failed' }
+}
+
+function positivePrNumber(value) {
+  const number = Number(value)
+  return Number.isInteger(number) && number > 0 ? number : null
+}
+
+// The batch relationship is only queried after a terminal dequeue verdict, so normal polls
+// remain the documented two reads. This one-shot enrichment cannot influence lifecycle state.
+function batchPrObservation({ repo, batchPrNumber, intervalSeconds, stallMinutes, admissionStallMinutes, maxMinutes, everActive }) {
+  const result = run('gh', ['pr', 'view', String(batchPrNumber), '--repo', repo, '--json', 'state,url,statusCheckRollup'], { timeout: readTimeoutForArgs({ intervalSeconds, stallMinutes, admissionStallMinutes, maxMinutes, everActive }) })
+  if (!result.ok) return { readable: false, failedChecks: [], error: result.stderr || result.stdout }
+  const data = parseJson(result.stdout)
+  if (!data) return { readable: false, failedChecks: [], error: 'gh pr view returned invalid JSON for synthetic batch PR' }
+  return { readable: true, state: data.state || null, url: data.url || null, ...summarizeStatusChecks(data.statusCheckRollup) }
+}
+
+export function classifyDequeue({ rawReason = null, failedChecks = [] } = {}) {
+  const statuses = new Set((Array.isArray(failedChecks) ? failedChecks : []).map((check) => String(check?.status || '').toUpperCase()))
+  if (['FAILURE', 'ERROR', 'TIMED_OUT', 'ACTION_REQUIRED', 'STARTUP_FAILURE'].some((status) => statuses.has(status))) return 'checks-failed'
+  if (statuses.has('CANCELLED')) return 'checks-cancelled'
+  const raw = String(rawReason || '').trim().toLowerCase()
+  if (/failing checks|checks failed/.test(raw)) return 'checks-failed'
+  if (/pull[- ]request.*updated|draft[- ]pull[- ]request.*changed/.test(raw)) return 'pull-request-updated'
+  if (/conflict/.test(raw)) return 'conflict'
+  if (/conditions[- ]unmet/.test(raw)) return 'conditions-unmet'
+  if (/frozen/.test(raw)) return 'frozen'
+  if (/manual|manually dequeued|dequeued by .*\bdequeue\b.*command/.test(raw)) return 'manual'
+  return 'unknown'
 }
 
 // Every poll's observation, as one compact NDJSON record — the watcher's heartbeat.
@@ -657,6 +719,7 @@ export async function runCli(argv) {
   let lastChangeMs = startedMs
   let observations = 0
   let phases = []
+  let lastBatchPrNumber = null
 
   for (;;) {
     // Pass everActive into the reads so their per-child timeout tracks the phase bound that
@@ -666,6 +729,9 @@ export async function runCli(argv) {
     const pr = prObservation({ ...args, everActive })
     const queue = queueObservation({ ...args, everActive })
     observations += 1
+    if (queue.readable !== false && queue.queued === true && queue.batchPrNumber) {
+      lastBatchPrNumber = queue.batchPrNumber
+    }
     const active = (Array.isArray(pr.labels) && pr.labels.includes('queued')) || queue.queued === true
     const readable = pr.readable !== false || queue.readable !== false
     if (active) {
@@ -687,16 +753,37 @@ export async function runCli(argv) {
     if (verdict.seenQueued === true) seenQueued = true
     if (verdict.preAdmission === true) phases = nextPhases(phases, 'NOT_YET_QUEUED')
     phases = nextPhases(phases, verdict.outcome)
+    let dequeue = null
+    if (verdict.outcome === 'DEQUEUED') {
+      const info = pr.dequeueInfo || { rawReason: null, batchPrNumber: null, providerFailedChecks: [] }
+      const batchPrNumber = lastBatchPrNumber ?? info.batchPrNumber ?? null
+      const batch = batchPrNumber ? batchPrObservation({ ...args, everActive, batchPrNumber }) : null
+      const failedChecks = batch?.readable && batch.failedChecks.length > 0
+        ? batch.failedChecks
+        : (info.providerFailedChecks || [])
+      const classifiedReason = classifyDequeue({ rawReason: info.rawReason, failedChecks })
+      dequeue = {
+        reason: classifiedReason === 'unknown' && !info.rawReason && failedChecks.length === 0
+          ? verdict.reason
+          : classifiedReason,
+        rawReason: info.rawReason || null,
+        batchPrNumber,
+        failedChecks,
+        batch,
+      }
+    }
     const payload = {
       outcome: verdict.outcome,
       terminal: verdict.terminal,
-      reason: verdict.reason || null,
+      reason: dequeue?.reason || verdict.reason || null,
+      rawReason: dequeue?.rawReason || null,
       detail: verdict.detail || null,
       mergedSha: verdict.mergedSha || null,
+      batchPrNumber: dequeue?.batchPrNumber || lastBatchPrNumber,
       seenQueued,
       everActive,
       phases,
-      failedChecks: verdict.failedChecks || pr.failedChecks || [],
+      failedChecks: dequeue?.failedChecks || verdict.failedChecks || pr.failedChecks || [],
       missingActiveReads,
       observations,
       elapsedMs: Date.now() - startedMs,
@@ -711,7 +798,21 @@ export async function runCli(argv) {
         failedChecks: pr.failedChecks || [],
         pendingChecks: pr.pendingChecks || [],
       },
-      queue: { queued: queue.queued === true, queueState: queue.queueState || null, position: queue.position ?? null, readable: queue.readable !== false },
+      queue: {
+        queued: queue.queued === true,
+        queueState: queue.queueState || null,
+        position: queue.position ?? null,
+        batchPrNumber: queue.batchPrNumber || null,
+        lastBatchPrNumber,
+        readable: queue.readable !== false,
+      },
+      batchPr: dequeue?.batch ? {
+        number: dequeue.batchPrNumber,
+        state: dequeue.batch.state || null,
+        url: dequeue.batch.url || null,
+        readable: dequeue.batch.readable !== false,
+        error: dequeue.batch.error || null,
+      } : null,
     }
 
     if (verdict.terminal) {

package/skills/engineering/e2e-test/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: e2e-test
 description: "Playwright end-to-end standard: the 3-tier suite (render-health / functional / journey), generated route manifest, presentation sweep, and CI route gates. Use when browser routes or user flows ship or change, or a Playwright test flakes. NOT for non-browser tests, defining what to test (ensure-coverage), or the curated ALIVE/DEAD gate (smoke)."
+disable-model-invocation: true
 ---
 
 # E2E Testing Standard

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -383,7 +383,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
       "contentDigest": "eff6c7b5931bce5b2265a619bccddd371a89df6ce7bc2edc74f11d00060a71dd",
       "digestExcludes": []
@@ -396,9 +396,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
-      "contentDigest": "08230dc57a53d6526692b50138038abbd80abce1a067e01c52ad6acc182caf7e",
+      "contentDigest": "d97abeff7bdc5ae2e4be2f631d09dba46d4753ce1e67334793364329af59f066",
       "digestExcludes": []
     },
     {
@@ -409,9 +409,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
-      "contentDigest": "9eea7bfba348ddaea1b934c9a7fabdd9b101df8a146e1c93e947da4d335f1d98",
+      "contentDigest": "00cfdd3e5bfbc3e37b1369ad93aae91161e671829760a8867ea9be25047ba461",
       "digestExcludes": []
     },
     {
@@ -422,7 +422,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
       "contentDigest": "58b0556228a9271cf9e33727a05fc08a4fdfd29512ec0936b169f0a55d60e6ef",
       "digestExcludes": []
@@ -435,9 +435,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
-      "contentDigest": "38347c30820ba7e8b10433aeb351b7df4fa457b143e4a109293ab53fda961459",
+      "contentDigest": "4664873230f22de2fcf46b7b529570cfedabdc850620031d8f96baf89fcdc5b4",
       "digestExcludes": []
     },
     {
@@ -448,9 +448,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
-      "contentDigest": "d32add939c8c673e3bb096dfc95a5aadfa31115c3a854b3a4e0eb3fed1b49794",
+      "contentDigest": "a2df894683012581ce57e92d6e2dacd7eb377e4a0547a98acaea04878ef6aa3a",
       "digestExcludes": []
     },
     {
@@ -461,9 +461,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
-      "contentDigest": "125318612fe3fd70354ba5393a7019b3e6db5acc14a0d3f653a31f6b06a2e267",
+      "contentDigest": "01c192d8b4fd416af4ea02e8000e5fce0cee723a6ac2f8c0c48372087e1a262e",
       "digestExcludes": []
     },
     {
@@ -474,7 +474,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
       "contentDigest": "ffba0c83491676794c74721f4c6dbae430f5bc186e5a55f0764e29eaeb13829b",
       "digestExcludes": []
@@ -487,7 +487,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
       "contentDigest": "f048fd00c69f2dc666fc7a3096cfeee6dfba73933bfb69602f3f0e26159798cc",
       "digestExcludes": []
@@ -500,7 +500,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
       "contentDigest": "90a7c4e1ad6da1e632ea2c5259e4967ffebb84353adccbca8dfc5d6bc50b60c1",
       "digestExcludes": []
@@ -513,15 +513,15 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       },
-      "contentDigest": "16dcd5bc2b40c8ae7cf6bc41eadd943264b03e70162c3da85624f11a2112bf56",
+      "contentDigest": "ab98e937973720aedf6f79a63e99650fe3488f4f798d46ed3ae606f0b12a2a41",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "6f89ee339ca1319fbd167658b1dbb66a1357b482463ba829bf22bf7b0c7c28a3",
+  "releaseIdentity": "0fb67095c481e3a37f57b149e3557c5e450fa93fa3077888ab1eb2bf1ac3d196",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",
@@ -579,7 +579,7 @@
         "sourceId": "first-party",
         "sourceType": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0",
+        "version": "0.19.2",
         "installPath": null,
         "members": [
           "harness-runtime",
@@ -597,7 +597,7 @@
         "commands": [
           {
             "transport": "npm",
-            "command": "npx @1aboveio/skills@0.19.0 install --group engineering-workflow --yes"
+            "command": "npx @1aboveio/skills@0.19.2 install --group engineering-workflow --yes"
           }
         ],
         "onFailure": {

package/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -119,7 +119,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.19.0',
+    version: '0.19.2',
   },
   matt: {
     id: 'matt-pocock',

package/skills/engineering/ensure-coverage/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: ensure-coverage
 description: "Define or audit behavior-first test criteria — ACs, required test levels, evidence expectations, mock/integration/E2E policy — across three axes: breadth (Coverage Ledger), depth (over-mocking), presentation (perceivability of browser surfaces). NOT the merge verdict on a PR (review-pr), authoring browser tests (e2e-test), or driving issues to PRs (resolve-issues)."
+disable-model-invocation: true
 ---
 
 # Ensure Coverage

package/skills/engineering/resolve-issues/generated/workflow-repair-policy.json

@@ -237,7 +237,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -248,7 +248,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -259,7 +259,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -270,7 +270,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -281,7 +281,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -292,7 +292,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -303,7 +303,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -314,7 +314,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -325,7 +325,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -336,7 +336,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     },
     {
@@ -347,7 +347,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0"
+        "version": "0.19.2"
       }
     }
   ],
@@ -468,7 +468,7 @@
         "sourceId": "first-party",
         "sourceType": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.0",
+        "version": "0.19.2",
         "installPath": null,
         "members": [
           "harness-runtime",
@@ -486,7 +486,7 @@
         "commands": [
           {
             "transport": "npm",
-            "command": "npx @1aboveio/skills@0.19.0 install --group engineering-workflow --yes"
+            "command": "npx @1aboveio/skills@0.19.2 install --group engineering-workflow --yes"
           }
         ],
         "onFailure": {

package/skills/engineering/resolve-issues/scripts/run-state.mjs

@@ -3412,7 +3412,7 @@ export const WORKFLOW_PREFLIGHT_COMMANDS = Object.freeze([
 
 const WORKFLOW_VERIFIER_URL = new URL('../../engineering-runtime/scripts/workflow-coherence.mjs', import.meta.url)
 const WORKFLOW_FALLBACK_POLICY_URL = new URL('../generated/workflow-repair-policy.json', import.meta.url)
-export const WORKFLOW_TRUSTED_FALLBACK_POLICY_SHA256 = '27d1fb2d0bdf9ca37933dff2f0e1863d95f9f147baecbbce9dd3553a4c71a915'
+export const WORKFLOW_TRUSTED_FALLBACK_POLICY_SHA256 = '8fb804c3034b780877774f6228166716ee98d1b39986adac397ac33c0feebfb5'
 const WORKFLOW_REPAIR_RECIPE_REFERENCE = Object.freeze({
   id: 'engineering-workflow-dependency-first',
   generatedFrom: 'skills/distribution/generated/recipes.json',

package/skills/engineering/rush-issues/SKILL.md

@@ -72,6 +72,10 @@ before its stage; do not invent an unlinked substitute.
   canary and requires validation plus a fresh canary on the new HEAD.
 - Review facts independently. Producer summaries, claims, logs, and evidence
   may locate work but cannot establish correctness for the reviewer.
+- Treat review P0/P1 findings as blocking. P2/P3 findings do not expand the
+  current PR, but each must be linked to a concrete follow-up before review
+  succeeds; a finding that proves a current AC or mandatory standard is unmet
+  must be reclassified as P1, not deferred under a softer label.
 - Do not manufacture review evidence collateral. Keep only the stage result,
   commands actually run, findings, task-plan transitions, and profiling events.
 - Persist each task-plan transition and profiling event under one monotonically
@@ -144,8 +148,8 @@ the original spec and repository standards, computes its own diff fixed point,
 inspects the implementation, and runs checks needed to verify findings. It does
 not accept producer evidence as proof. Fix blocking findings on the combined
 branch, validate, rerun the warehouse canary when required, then run a fresh
-review until successful; after 2 failed fix/review cycles, diagnose and continue
-with a revised approach.
+review until every P0/P1 is resolved and every P2/P3 has a tracked follow-up;
+after 2 failed fix/review cycles, diagnose and continue with a revised approach.
 
 ### 7. CICD
 

package/skills/engineering/rush-issues/references/review.md

@@ -24,17 +24,41 @@ new evidence collateral as a substitute for verification.
    for the current exact HEAD. Then invoke the absolute `code-review` skill path
    on the combined HEAD.
 2. Review both axes: repository **Standards** and original **Spec**.
+   Treat `code-review` as a barrier: buffer individual Standards and Spec
+   completions, and do not classify, defer, or fix any finding until both axes
+   have returned and one aggregated review result exists.
 3. Independently run or reproduce the checks needed to support each material
    conclusion. A producer-provided green log is not a factual substitute.
-4. Return findings with severity and file/line references, plus commands the
-   reviewer actually ran. The review result is coordination state, not an
+4. Return findings with P0-P3 severity and file/line references, plus commands
+   the reviewer actually ran. The review result is coordination state, not an
    evidence-generation deliverable.
-5. Succeed only with no Spec gap/wrongness/creep and no hard Standards
-   violation. Record non-blocking baseline observations as deferrals.
+5. Apply the severity/disposition policy below. Succeed only when every finding
+   has an explicit resolved or deferred disposition.
+
+## Severity and disposition
+
+- **P0/P1 are blocking.** Fix them on the combined branch, validate, rerun the
+  required canary, and obtain a fresh review before recording `reviewedHead`.
+- **P2/P3 are non-blocking by default.** Do not expand the current PR to address
+  them. Create or link a concrete follow-up issue before review succeeds and
+  record its URL with the finding.
+- **No finding disappears.** Each finding is either `resolved` on the exact
+  reviewed HEAD or `deferred` with a follow-up URL. A prose note without a
+  trackable issue is not a disposition.
+- **Severity cannot waive the current contract.** If a purported P2/P3 proves
+  that a current acceptance criterion is unmet, required behavior is wrong, or
+  a mandatory repository standard or gate is violated, ask the reviewer to
+  reclassify it as P1. Do not silently override the reviewer and do not defer it
+  under the softer label.
+
+P2/P3 follow-ups are appropriate for optional hardening, cleanup, cosmetic
+improvements, and architecture work outside the current acceptance criteria.
+Link each follow-up to the combined PR and original spec, and deduplicate it
+against existing issues before creating a new one.
 
 ## Fix loop
 
-For blocking findings, fix the combined PR branch, run relevant lint/build/
+For P0/P1 findings, fix the combined PR branch, run relevant lint/build/
 test/smoke, rerun [canary.md](canary.md) when required, then spawn a fresh
 review of the new HEAD. Record that exact SHA as `reviewedHead` only after
 success. Never treat a fix as accepted before validation, required canary, and

package/skills/engineering/rush-issues/references/task-plan.md

@@ -47,7 +47,11 @@ Run-level fields include `planRevision`, models/efforts, `targetBranch`, run
 workspace/branch, original spec locator, explicit merge authorization when one
 was supplied, exploration path, combined PR/HEAD, `reviewedHead`, and
 `warehouseCanaryRequired`, its classification reason, durable canary result
-path, and start/update timestamps.
+path, `reviewFindings`, and start/update timestamps. Each `reviewFindings` entry
+records a stable finding id, P0-P3 `severity`, summary and source locator,
+`status` (`open`, `resolved`, or `deferred`), the exact `resolvedHead` when
+resolved, and `followUpUrl` when deferred. P0/P1 cannot be deferred; P2/P3
+cannot remain open when `reviewedHead` is recorded.
 
 Persist the machine-readable plan at:
 

package/skills/engineering/rush-release/references/cut.md

@@ -51,8 +51,13 @@ git commit -m "chore(release): <nextVersion>"
 `apply.mjs` requires the confirmed plan's `changelogMarkdown` on stdin, writes
 that section, and bumps the discovered identity files. It refuses a missing or
 empty changelog section rather than silently replacing the plan with a bare
-version heading. If the human edited the notes, write the confirmed markdown
-to stdin instead of the raw plan field.
+version heading. When the plan names `skills/distribution/manifest.json`, it
+delegates to `distribution.mjs version-cut`; that operation updates the public
+npm identity, trusted installed-workflow identity and fallback hash together,
+then regenerates the repository's deterministic distribution artifacts. If any
+step fails it restores every identity and generated file before returning.
+If the human edited the notes, write the confirmed markdown to stdin instead
+of the raw plan field.
 
 Then:
 

package/skills/engineering/rush-release/references/preflight.md

@@ -28,14 +28,22 @@ workflow publishes on `release: published` rather than on tag push, note that
 
 ## 3. Version files
 
-List identity files present at the repo root (and only those):
+First check for `skills/distribution/manifest.json` with exactly one `public-npm`
+render target and `skills/distribution/scripts/distribution.mjs`. That manifest is
+the release identity when present; record it and use the distribution-aware cut in
+`apply.mjs`. It takes precedence over a private root `package.json` with no version,
+because adding a synthetic root version would not change what the publisher ships.
+
+Otherwise, list identity files present at the repo root (and only those):
 
 - `package.json` (and `package-lock.json` when it exists)
 - `pyproject.toml`
 - `VERSION`
 
-Do not bump nested workspace packages unless the human names them. The cut
-must stay metadata-only.
+Do not bump other nested workspace packages unless the human names them. The cut
+must stay metadata-only. A distribution-aware cut may also update trusted runtime
+identity constants, test fixtures that pin that identity, and deterministic generated
+policy/inventory artifacts; those are version metadata, not product behavior.
 
 ## 4. Baseline
 

package/skills/engineering/rush-release/scripts/apply.mjs

@@ -7,8 +7,9 @@
 // Exit: 0 ok · 1 IO/parse failed · 2 usage
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
 import { isMainModule } from '../../engineering-runtime/scripts/main-module.mjs'
-import { discoverVersionFiles, parseSemver } from './plan.mjs'
+import { DISTRIBUTION_MANIFEST, discoverVersionFiles, parseSemver } from './plan.mjs'
 
 export function insertChangelog(markdown, { version, date, section }) {
   const heading = `## [${version}] - ${date}`
@@ -90,11 +91,32 @@ export function bumpPyproject(text, version) {
   return out.join('\n')
 }
 
+export function cutDistributionVersion({ version, cwd }) {
+  const script = join(cwd, 'skills/distribution/scripts/distribution.mjs')
+  const result = spawnSync(process.execPath, [script, 'version-cut', '--version', version, '--repo-root', cwd, '--json'], {
+    cwd,
+    encoding: 'utf8',
+  })
+  if (result.status !== 0) {
+    const error = new Error(result.stderr.trim() || 'distribution version cut failed')
+    error.exitCode = result.status || 1
+    throw error
+  }
+  const parsed = JSON.parse(result.stdout)
+  if (!Array.isArray(parsed.changed) || parsed.changed.length === 0) {
+    const error = new Error('distribution version cut returned no changed files')
+    error.exitCode = 1
+    throw error
+  }
+  return parsed.changed
+}
+
 export function applyRelease({
   version,
   date,
   cwd = process.cwd(),
   changelogSection = null,
+  cutDistribution = cutDistributionVersion,
   now = new Date(),
 } = {}) {
   if (!parseSemver(version)) {
@@ -115,6 +137,11 @@ export function applyRelease({
   writeFileSync(changelogPath, insertChangelog(previous, { version, date: stamp, section: changelogSection }))
   changed.push('CHANGELOG.md')
 
+  if (files.includes(DISTRIBUTION_MANIFEST)) {
+    changed.push(...cutDistribution({ version, cwd }))
+    return { version, date: stamp, changed: [...new Set(changed)] }
+  }
+
   if (files.includes('package.json')) {
     writeFileSync(join(cwd, 'package.json'), bumpPackageJson(readFileSync(join(cwd, 'package.json'), 'utf8'), version))
     changed.push('package.json')

package/skills/engineering/rush-release/scripts/plan.mjs

@@ -22,6 +22,7 @@ const SECTION_BY_TYPE = {
 }
 const INTERNAL_TYPES = new Set(['build', 'chore', 'ci', 'docs', 'style', 'test'])
 const SECTION_ORDER = ['Breaking', 'Added', 'Changed', 'Removed', 'Fixed', 'Security']
+export const DISTRIBUTION_MANIFEST = 'skills/distribution/manifest.json'
 
 export function parseSemver(input) {
   const match = SEMVER_RE.exec(String(input || '').trim())
@@ -104,7 +105,24 @@ export function renderChangelog({ version, date, changes }) {
   return `${lines.join('\n')}\n`
 }
 
+function distributionVersion(text) {
+  try {
+    const manifest = JSON.parse(text)
+    const targets = (manifest.sources ?? [])
+      .flatMap((source) => source.renderTargets ?? [])
+      .filter((target) => target.id === 'public-npm')
+    if (targets.length !== 1 || !parseSemver(targets[0].version)) return null
+    return formatVersion(parseSemver(targets[0].version))
+  } catch {
+    return null
+  }
+}
+
 export function discoverVersionFiles(root) {
+  const distributionPath = join(root, DISTRIBUTION_MANIFEST)
+  if (existsSync(distributionPath) && distributionVersion(readFileSync(distributionPath, 'utf8'))) {
+    return [DISTRIBUTION_MANIFEST]
+  }
   const files = []
   for (const name of ['package.json', 'package-lock.json', 'pyproject.toml', 'VERSION']) {
     if (existsSync(join(root, name))) files.push(name)
@@ -113,6 +131,9 @@ export function discoverVersionFiles(root) {
 }
 
 export function currentVersionFromFiles(root, files = discoverVersionFiles(root)) {
+  if (files.includes(DISTRIBUTION_MANIFEST)) {
+    return distributionVersion(readFileSync(join(root, DISTRIBUTION_MANIFEST), 'utf8'))
+  }
   if (files.includes('package.json')) {
     const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
     const parsed = parseSemver(pkg.version)
@@ -146,12 +167,19 @@ function versionFilesAt(sha, cwd) {
     .split('\n')
     .map((line) => line.trim())
     .filter(Boolean))
+  if (tree.has(DISTRIBUTION_MANIFEST)) {
+    const version = distributionVersion(git(['show', `${sha}:${DISTRIBUTION_MANIFEST}`], cwd))
+    if (version) return [DISTRIBUTION_MANIFEST]
+  }
   return ['package.json', 'package-lock.json', 'pyproject.toml', 'VERSION']
     .filter((name) => tree.has(name))
 }
 
 function versionFromGitFiles(sha, files, cwd) {
   const contents = (path) => git(['show', `${sha}:${path}`], cwd)
+  if (files.includes(DISTRIBUTION_MANIFEST)) {
+    return distributionVersion(contents(DISTRIBUTION_MANIFEST))
+  }
   if (files.includes('package.json')) {
     const parsed = parseSemver(JSON.parse(contents('package.json')).version)
     if (parsed) return formatVersion(parsed)