@carecard/validate 3.29.0 → 3.31.0

package/.agents/skills/carecard-must-do/SKILL.md

@@ -1,10 +1,18 @@
 ---
 name: carecard-must-do
-description: 'Non-negotiable startup requirements for every agent, including Codex, Claude, other assistants, and delegated agents. Load first whenever beginning or resuming any task to govern questions, visible working copies, and agent-named branches.'
+description: 'Non-negotiable startup requirements for every agent, including Codex, Claude, other assistants, and delegated agents. Load first whenever beginning or resuming any task to govern questions, visible working copies, and working-branch continuity.'
 ---
 
 # CareCard Must Do
 
+## Explicit approval before GitHub settings changes
+
+Before changing any GitHub setting, explain the exact proposed change, ask the
+user explicitly, and wait for their approval. This includes temporary changes
+to GitHub Actions, workflow enablement, branch protection, and repository or
+organization settings. Authorization to commit, push, merge, tag, cancel runs,
+or clean up branches does not authorize settings changes.
+
 ## Mandatory for every agent
 
 Every agent must read and follow this skill before beginning or resuming work
@@ -61,18 +69,34 @@ resources owned by the task when cleanup is authorized. Ordinary temporary
 logs, build artifacts, and test fixtures are permitted when they are not used
 as an undisclosed replacement working repository.
 
-## Work on an agent-named branch
-
-Before changing repository files, create and switch to a task-specific branch
-named `<agent-name>/<task-name>` in the owning repository. Use the agent's
-recognizable lowercase name and a descriptive task name, such as
-`codex/carecard-must-do`, `claude/fix-login`, or `junie/update-validation`.
-Reuse an existing agent-named branch only when continuing that same task.
-Read-only investigation and planning do not require creating a branch.
+## Choose and refresh the working branch
+
+Reuse the current working branch for every follow-up request, even when the
+subject changes or the working tree is clean. Create a branch only when no
+working branch exists or the checkout is on `main` or `development`. Otherwise,
+fetch remote `main` HEAD and rebase the same working branch onto that fetched
+commit, preserving its commits and uncommitted work.
+
+Identify the repository directory, current branch, and working-tree state.
+Fetch `origin/main` at task start before making task changes.
+
+- Create and switch to a new `<agent-name>/<branch-name>` branch from freshly
+  fetched `origin/main` only when no working branch exists or the current branch is
+  `main` or `development`. Use the agent's recognizable lowercase name and a
+  descriptive
+  branch name, or the exact branch name supplied by the user.
+- On every other branch, keep the current branch and rebase it onto freshly
+  fetched `origin/main` before starting task changes. Preserve its existing
+  commits and build the new task's commits on top of that work. Reuse this
+  branch for subsequent tasks, including when the working tree is clean or
+  the new task differs from the previous one.
+
+Preserve uncommitted changes when preparing the rebase and restore any changes
+that were temporarily set aside. Do not reset, replace, squash, or discard the
+current branch's work merely to start a new task. Honor explicit user
+working-branch instructions. Read-only investigation and planning do not
+require creating a branch.
 
-Identify the repository directory and working branch before making changes.
-Preserve existing commits and unrelated local changes. Start new work from
-freshly fetched `origin/main`, or rebase continuing work onto it when needed.
 Fetch again before every source-branch push and rebase when the branch does
 not already contain the latest `origin/main`.
 

package/.agents/skills/carecard-workspace-standards/SKILL.md

@@ -193,11 +193,20 @@ making a new commit in the affected repository.
 
 ## Agent Guidance Git Workflow
 
+Reuse the current working branch for every follow-up request, even when the
+subject changes or the working tree is clean. Create a branch only when no
+working branch exists or the checkout is on `main` or `development`. Otherwise,
+fetch remote `main` HEAD and rebase the same working branch onto that fetched
+commit, preserving its commits and uncommitted work.
+
 Work from the owning repository root and stage only intended guidance changes.
-Use freshly fetched `origin/main` as the default base. Start `<agent-name>/<task-name>`
-from it, or rebase existing work when it does not already contain the latest
-`origin/main`. An explicit user instruction to use the current or another
-working branch overrides the default `<agent-name>/<task-name>` selection.
+Fetch fresh `origin/main` at task start. Create `<agent-name>/<branch-name>`
+from it only when no working branch exists or the current branch is `main` or
+`development`. Otherwise keep
+and rebase the current branch onto it, preserving existing commits and
+uncommitted changes. Build subsequent task commits on that same branch, even
+for a different task or a clean working tree. Honor explicit user
+working-branch instructions.
 
 Fetch again before every source-branch push and rebase only when the branch
 does not already contain the latest `origin/main`. Required fetches need no

package/.agents/skills/github-pr-create-update/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: github-pr-create-update
-description: 'Use when asked to push, create, update, or ready a GitHub pull request. Default to main, fetch origin/main at the start and before source pushes, rebase when needed, and preserve main from deletion or force pushes.'
+description: 'Use when asked to push, create, update, or ready a GitHub pull request. Default PRs to main. Create a branch from fresh origin/main only without a working branch or from main or development; otherwise preserve and rebase the current branch for subsequent tasks. Fetch again before source pushes and preserve main from deletion or force pushes.'
 ---
 
 Non-negotiable root-cause solution rule: Always identify and solve the verified root cause, use the stronger solution, and deliver a correct, durable, production-quality result. Never treat a temporary workaround, resource increase, retry, suppression, bypass, or symptom-only patch as completion. Validate the root-cause fix against the real failing workflow and prove the end state.
@@ -19,6 +19,12 @@ Non-negotiable code organization rule: Functions with the same or equivalent beh
 
 ## Default Git Policy
 
+Reuse the current working branch for every follow-up request, even when the
+subject changes or the working tree is clean. Create a branch only when no
+working branch exists or the checkout is on `main` or `development`. Otherwise,
+fetch remote `main` HEAD and rebase the same working branch onto that fetched
+commit, preserving its commits and uncommitted work.
+
 Apply these defaults unless the user explicitly specifies otherwise. The
 prohibition on deleting or force-pushing `main` always applies.
 
@@ -26,9 +32,13 @@ prohibition on deleting or force-pushing `main` always applies.
    truth. `origin/HEAD`, a stale local `main`, and the presence of `development`
    do not change this default. If remote `main` is missing or cannot be fetched,
    report the blocker instead of selecting another base.
-2. At task start, fetch `origin/main`, then create new work from that commit or
-   rebase the existing working branch onto it when needed. Honor an explicit
-   working-branch instruction; it changes branch selection, not freshness.
+2. At task start, fetch `origin/main`. Create `<agent-name>/<branch-name>`
+   from that commit only when no working branch exists or the current branch is
+   `main` or `development`.
+   Otherwise keep and rebase the current branch onto that commit, preserving
+   its existing commits and building subsequent task commits on top. Honor an
+   explicit working-branch instruction; it changes branch selection, not
+   freshness.
 3. Fetch again before every source-branch push. Rebase when the working branch
    does not already contain the latest `origin/main`; a clean mergeability
    check is not proof that rebasing is unnecessary. If it already contains that
@@ -65,11 +75,15 @@ with `--force-with-lease`.
 
 Work from the owning repository root. Inspect status, the current branch,
 upstream, and worktrees before changing refs. Preserve unrelated changes and
-existing commits; do not reset a working branch to discard its work. Use the
-user-named branch, or the current source branch for a single-repository task.
-If starting new work while on `main`, create a task branch from fresh
-`origin/main`. Do not use `main` or the selected base as a PR source branch.
-Stop if the source branch cannot be resolved or HEAD is detached.
+existing commits; do not reset a working branch to discard its work. Honor the
+user's explicit working-branch instruction. Create a new
+`<agent-name>/<branch-name>` from fresh `origin/main` only when no working branch
+exists or the current branch is `main` or `development`. Otherwise keep the current
+branch, rebase it
+onto fresh `origin/main`, and build the new task's commits on its existing
+work. A different task or a clean working tree does not require a new branch.
+Do not use `main` or the selected base as a PR source branch. Stop if the source
+branch cannot be resolved or HEAD is detached.
 
 Fetch the authoritative ref explicitly:
 
@@ -77,22 +91,16 @@ Fetch the authoritative ref explicitly:
 git fetch origin refs/heads/main:refs/remotes/origin/main
 ```
 
-For an existing working branch, check whether it includes the fetched commit:
+For an existing working branch, preserve any uncommitted changes and rebase
+before starting task changes; restore any changes temporarily set aside:
 
 ```sh
-if git merge-base --is-ancestor origin/main HEAD; then
-  printf '%s\n' 'Working branch already contains the latest origin/main.'
-else
-  ancestry_result=$?
-  if [ "$ancestry_result" -ne 1 ]; then
-    exit "$ancestry_result"
-  fi
-  git rebase origin/main
-fi
+git rebase origin/main
 ```
 
-Repeat the fetch and ancestry check before every source-branch push, including
-pushes after validation fixes. If rebasing changes the validated inputs, rerun
+Before every source-branch push, including pushes after validation fixes,
+fetch again and rebase when the branch does not already contain the latest
+`origin/main`. If rebasing changes the validated inputs, rerun
 the affected validation. Preserve successful evidence for unchanged inputs.
 If a rebase conflicts, abort only the rebase started by this task and report
 the conflict; do not push or discard work. Preserve any pre-existing Git

package/.agents/skills/github-pr-merge-cleanup/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: github-pr-merge-cleanup
-description: 'Use for authorized GitHub PR squash merge and source cleanup. Default to fresh origin/main, rebase when needed, delete merged source branches, and synchronize main and development without deleting or force-pushing main.'
+description: 'Use for authorized GitHub PR squash merge and source cleanup. Create a branch from fresh origin/main only without a working branch or from main or development; otherwise preserve and rebase the current branch for subsequent tasks. Delete merged source branches, and synchronize main and development without deleting or force-pushing main.'
 ---
 
 Non-negotiable root-cause solution rule: Always identify and solve the verified root cause, use the stronger solution, and deliver a correct, durable, production-quality result. Never treat a temporary workaround, resource increase, retry, suppression, bypass, or symptom-only patch as completion. Validate the root-cause fix against the real failing workflow and prove the end state.
@@ -19,6 +19,12 @@ Non-negotiable code organization rule: Functions with the same or equivalent beh
 
 ## Default Git Policy
 
+Reuse the current working branch for every follow-up request, even when the
+subject changes or the working tree is clean. Create a branch only when no
+working branch exists or the checkout is on `main` or `development`. Otherwise,
+fetch remote `main` HEAD and rebase the same working branch onto that fetched
+commit, preserving its commits and uncommitted work.
+
 Apply these defaults unless the user explicitly specifies otherwise. The
 prohibition on deleting or force-pushing `main` always applies.
 
@@ -26,9 +32,13 @@ prohibition on deleting or force-pushing `main` always applies.
    truth. `origin/HEAD`, a stale local `main`, and the presence of `development`
    do not change this default. If remote `main` is missing or cannot be fetched,
    report the blocker instead of selecting another base.
-2. At task start, fetch `origin/main`, then create new work from that commit or
-   rebase the existing working branch onto it when needed. Honor an explicit
-   working-branch instruction; it changes branch selection, not freshness.
+2. At task start, fetch `origin/main`. Create `<agent-name>/<branch-name>`
+   from that commit only when no working branch exists or the current branch is
+   `main` or `development`.
+   Otherwise keep and rebase the current branch onto that commit, preserving
+   its existing commits and building subsequent task commits on top. Honor an
+   explicit working-branch instruction; it changes branch selection, not
+   freshness.
 3. Fetch again before every source-branch push. Rebase when the working branch
    does not already contain the latest `origin/main`; a clean mergeability
    check is not proof that rebasing is unnecessary. If it already contains that
@@ -65,11 +75,15 @@ with `--force-with-lease`.
 
 Work from the owning repository root. Inspect status, the current branch,
 upstream, and worktrees before changing refs. Preserve unrelated changes and
-existing commits; do not reset a working branch to discard its work. Use the
-user-named branch, or the current source branch for a single-repository task.
-If starting new work while on `main`, create a task branch from fresh
-`origin/main`. Do not use `main` or the selected base as a PR source branch.
-Stop if the source branch cannot be resolved or HEAD is detached.
+existing commits; do not reset a working branch to discard its work. Honor the
+user's explicit working-branch instruction. Create a new
+`<agent-name>/<branch-name>` from fresh `origin/main` only when no working branch
+exists or the current branch is `main` or `development`. Otherwise keep the current
+branch, rebase it
+onto fresh `origin/main`, and build the new task's commits on its existing
+work. A different task or a clean working tree does not require a new branch.
+Do not use `main` or the selected base as a PR source branch. Stop if the source
+branch cannot be resolved or HEAD is detached.
 
 Fetch the authoritative ref explicitly:
 
@@ -77,22 +91,16 @@ Fetch the authoritative ref explicitly:
 git fetch origin refs/heads/main:refs/remotes/origin/main
 ```
 
-For an existing working branch, check whether it includes the fetched commit:
+For an existing working branch, preserve any uncommitted changes and rebase
+before starting task changes; restore any changes temporarily set aside:
 
 ```sh
-if git merge-base --is-ancestor origin/main HEAD; then
-  printf '%s\n' 'Working branch already contains the latest origin/main.'
-else
-  ancestry_result=$?
-  if [ "$ancestry_result" -ne 1 ]; then
-    exit "$ancestry_result"
-  fi
-  git rebase origin/main
-fi
+git rebase origin/main
 ```
 
-Repeat the fetch and ancestry check before every source-branch push, including
-pushes after validation fixes. If rebasing changes the validated inputs, rerun
+Before every source-branch push, including pushes after validation fixes,
+fetch again and rebase when the branch does not already contain the latest
+`origin/main`. If rebasing changes the validated inputs, rerun
 the affected validation. Preserve successful evidence for unchanged inputs.
 If a rebase conflicts, abort only the rebase started by this task and report
 the conflict; do not push or discard work. Preserve any pre-existing Git

package/.agents/skills/pkg-publish/SKILL.md

@@ -68,6 +68,12 @@ synchronization must reuse the same version; it is not a second release.
 
 ## Default Git Policy
 
+Reuse the current working branch for every follow-up request, even when the
+subject changes or the working tree is clean. Create a branch only when no
+working branch exists or the checkout is on `main` or `development`. Otherwise,
+fetch remote `main` HEAD and rebase the same working branch onto that fetched
+commit, preserving its commits and uncommitted work.
+
 Apply these defaults unless the user explicitly specifies otherwise. The
 prohibition on deleting or force-pushing `main` always applies.
 
@@ -75,9 +81,13 @@ prohibition on deleting or force-pushing `main` always applies.
    truth. `origin/HEAD`, a stale local `main`, and the presence of `development`
    do not change this default. If remote `main` is missing or cannot be fetched,
    report the blocker instead of selecting another base.
-2. At task start, fetch `origin/main`, then create new work from that commit or
-   rebase the existing working branch onto it when needed. Honor an explicit
-   working-branch instruction; it changes branch selection, not freshness.
+2. At task start, fetch `origin/main`. Create `<agent-name>/<branch-name>`
+   from that commit only when no working branch exists or the current branch is
+   `main` or `development`.
+   Otherwise keep and rebase the current branch onto that commit, preserving
+   its existing commits and building subsequent task commits on top. Honor an
+   explicit working-branch instruction; it changes branch selection, not
+   freshness.
 3. Fetch again before every source-branch push. Rebase when the working branch
    does not already contain the latest `origin/main`; a clean mergeability
    check is not proof that rebasing is unnecessary. If it already contains that

package/.agents/skills/pkg-validate-coding-standards-and-best-practices/SKILL.md

@@ -5,6 +5,25 @@ description: 'Use after carecard-must-do. Mandatory for every pkg-validate task,
 
 # Pkg Validate Coding Standards And Best Practices
 
+## Release 1.1.1 and production data
+
+CareCard Release 1.1.1 is the production baseline. Seeding with
+`--seed-release-data` is complete. Production cluster data, database rows,
+and stored user files will be preserved going forward. There will be no
+complete user-data wipeout and re-creation.
+
+Future production changes must use data-preserving migrations. Do not replay
+the completed initialization or run reset, rollback, or seed workflows as part
+of ordinary production deployment.
+
+## Commit and merge documentation and skills with the task
+
+In each owning repository, include all task-related documentation, plans, and
+skill changes in the same commit as the related task changes. Merge them
+together into remote `main`. Do not leave changed documentation or skills
+uncommitted or unmerged, and do not declare the task complete until their
+inclusion in the merged commit is verified. Preserve unrelated work.
+
 First read [carecard-must-do](../carecard-must-do/SKILL.md); it is mandatory for every agent and task.
 Then apply this engineering standard before selecting narrower skills.
 
@@ -175,6 +194,12 @@ them unused and replaced.
 
 ## Completion
 
+Reuse the current working branch for every follow-up request, even when the
+subject changes or the working tree is clean. Create a branch only when no
+working branch exists or the checkout is on `main` or `development`. Otherwise,
+fetch remote `main` HEAD and rebase the same working branch onto that fetched
+commit, preserving its commits and uncommitted work.
+
 1. Review each changed repository's diff and status independently.
 2. Run focused runtime, type, and coverage tests, then all broader checks
    required by local skills.
@@ -184,11 +209,15 @@ them unused and replaced.
    none exists, run the strongest repository-native focused validation.
 5. Fix every in-scope failure at its root cause and rerun the exact command.
 6. Report exact commands, results, limitations, and remaining risk.
-7. Fetch the latest `origin/main` at task start and before every source-branch push;
-   these required fetches need no separate approval. Start new work from that
-   commit or rebase existing work when it does not already contain it. Commits,
-   pushes, PR mutations, and branch cleanup still require an authorized task.
-   Never delete local or remote `main` or force-push to remote `main`.
+7. Fetch the latest `origin/main` at task start and before every source-branch
+   push; these required fetches need no separate approval. Create
+   `<agent-name>/<branch-name>` from it only when no working branch exists or the
+   current branch is `main` or `development`. Otherwise rebase the current branch
+   onto it, preserving
+   existing commits and uncommitted changes, and build subsequent task commits
+   on that same branch. Commits, pushes, PR mutations, and branch cleanup still
+   require an authorized task. Never delete local or remote `main` or
+   force-push to remote `main`.
 
 ## TDD And Validation
 

package/.agents/skills/pkg-validate-validation-library/SKILL.md

@@ -211,11 +211,20 @@ with `--force-with-lease`.
 
 ## Agent Guidance Git Workflow
 
+Reuse the current working branch for every follow-up request, even when the
+subject changes or the working tree is clean. Create a branch only when no
+working branch exists or the checkout is on `main` or `development`. Otherwise,
+fetch remote `main` HEAD and rebase the same working branch onto that fetched
+commit, preserving its commits and uncommitted work.
+
 Work from the owning repository root and stage only intended guidance changes.
-Use freshly fetched `origin/main` as the default base. Start `<agent-name>/<task-name>`
-from it, or rebase existing work when it does not already contain the latest
-`origin/main`. An explicit user instruction to use the current or another
-working branch overrides the default `<agent-name>/<task-name>` selection.
+Fetch fresh `origin/main` at task start. Create `<agent-name>/<branch-name>`
+from it only when no working branch exists or the current branch is `main` or
+`development`. Otherwise keep
+and rebase the current branch onto it, preserving existing commits and
+uncommitted changes. Build subsequent task commits on that same branch, even
+for a different task or a clean working tree. Honor explicit user
+working-branch instructions.
 
 Fetch again before every source-branch push and rebase only when the branch
 does not already contain the latest `origin/main`. Required fetches need no

package/index.d.ts

@@ -84,7 +84,7 @@ export interface ValidateWhitelistPropertiesFunction {
 
 export const validateWhitelistProperties: ValidateWhitelistPropertiesFunction;
 
-export type UserRoleRequestRole = 'student' | 'intern' | 'volunteer';
+export type UserRoleRequestRole = 'student' | 'intern' | 'volunteer' | 'applicant';
 export type UserRoleRequestScopeRequirement =
   boolean | typeof REQUIRE_SCOPE_WHEN_ROLE_OR_SCOPE_PRESENT;
 
@@ -120,7 +120,7 @@ export interface ValidateNewUserRoleRequestPayload extends Record<string, unknow
 
 /**
  * Normalizes and validates an institutions.new_user_role_request payload.
- * Only student, intern, and volunteer are accepted. When scope is required,
+ * Only student, intern, volunteer, and applicant are accepted. When scope is required,
  * both institution_id and campus_id must be provided.
  */
 export function validateNewUserRoleRequestObject(

package/lib/validate.js

@@ -229,7 +229,7 @@ const isUserRoleRequestStatusString = inputString => {
 };
 
 const isUserRoleRequestRoleString = inputString => {
-  const roles = ['student', 'intern', 'volunteer'];
+  const roles = ['student', 'intern', 'volunteer', 'applicant'];
   return typeof inputString === 'string' && roles.includes(inputString.trim().toLowerCase());
 };
 

package/lib/validateNewUserRoleRequest.js

@@ -45,7 +45,7 @@ function normalizeNewUserRoleRequestRole(roleRequest) {
   if (!isUserRoleRequestRoleString(roleRequest.role_name)) {
     throwBadInputError({
       userMessage: 'Invalid property: role.role',
-      details: { role: 'Role requests are limited to student, intern, or volunteer' },
+      details: { role: 'Role requests are limited to student, intern, volunteer, or applicant' },
     });
   }
   roleRequest.role_name = roleRequest.role_name.trim().toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/validate",
-  "version": "3.29.0",
+  "version": "3.31.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/CareCard-ca/pkg-validate.git"
@@ -47,7 +47,7 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.29.0"
+    "@carecard/common-util": "3.31.0"
   },
   "nyc": {
     "all": true,

package/readme.md

@@ -1,5 +1,19 @@
 # @carecard/validate
 
+## Release 1.1.1 and production data
+
+CareCard Release 1.1.1 is the production baseline. Seeding with
+`--seed-release-data` is complete. Production cluster data, database rows,
+and stored user files will be preserved going forward. There will be no
+complete user-data wipeout and re-creation.
+
+Future production changes must use data-preserving migrations. Do not replay
+the completed initialization or run reset, rollback, or seed workflows as part
+of ordinary production deployment.
+
+The [completed seed inventory and verification record](https://github.com/CareCard-ca/cc-seed-data/blob/main/plans/production-seed-result.md)
+documents the accepted release baseline and verification limitations.
+
 Non-negotiable test order invariance rule: Every test must pass independently of which tests run before or after it, and the suite must pass in every execution order. Each test must establish the state it needs, isolate mutable state, and clean up state it owns; it must never rely on another test's setup, mutations, or cleanup. Default test, CI, and Husky commands must use the test framework's ordinary ordering and must not force randomized ordering. Random-order execution is an explicit diagnostic only, and every failure it exposes must be fixed at the root cause.
 
 Non-negotiable root-cause solution rule: Always identify and solve the verified root cause, use the stronger solution, and deliver a correct, durable, production-quality result. Never treat a temporary workaround, resource increase, retry, suppression, bypass, or symptom-only patch as completion. Validate the root-cause fix against the real failing workflow and prove the end state.
@@ -463,3 +477,10 @@ A correct implementation may be completely rewritten or refactored without requi
 Any test that fails solely because the implementation changed while the externally observable behavior remained correct is incorrectly designed and must be rewritten or removed.
 
 This requirement is mandatory for all new tests and must be applied whenever existing tests are modified.
+
+### Institution request roles
+
+`isUserRoleRequestRoleString`, `validateNewUserRoleRequest`, and the exported
+`UserRoleRequestRole` type accept student, intern, volunteer, and applicant.
+Institution and campus remain required. Provider-specific eligibility is owned
+by ms-institutions; accepting applicant here does not grant assignment authority.