@enrichlayer/el-linear 1.35.0 → 1.36.0

package/README.md

@@ -249,13 +249,14 @@ itself: `el-linear teams list --raw | jq '.[] | {key, id}'`, etc.
 
 ### Gate telemetry (optional)
 
-`issues create` has a duplicate-detection gate. el-linear can record each
-fire/override decision to a local JSONL file so you can measure the gate's
-**override-rate** and tell whether it's too aggressive. It is **off by default**
-and writes nothing unless you opt in (e.g. `export EL_TELEMETRY_DIR=<path>`);
-there is no server or database, and `EL_TELEMETRY_DISABLED=1` forces it off.
-Full opt-in rules, the event schema, and a `jq` reader are in
-[docs/telemetry.md](./docs/telemetry.md).
+`issues create` has a duplicate-detection gate (on by default) and an opt-in
+[SOP-label parent gate](./docs/configuration.md#sop-label-parent-gate-validationsoplabelparentgate).
+el-linear can record each gate's fire/override decision to a local JSONL file so
+you can measure its **override-rate** and tell whether it's too aggressive. It is
+**off by default** and writes nothing unless you opt in (e.g.
+`export EL_TELEMETRY_DIR=<path>`); there is no server or database, and
+`EL_TELEMETRY_DISABLED=1` forces it off. Full opt-in rules, the event schema, and
+a `jq` reader are in [docs/telemetry.md](./docs/telemetry.md).
 
 ### Networking (IPv4 preference)
 

package/claude-skills/linear-operations/SKILL.md

@@ -200,6 +200,21 @@ and outreach tracked in one place.
 > `validation.duplicateDetection: false` (field validation still runs);
 > `validation.enabled: false` turns off all validation.
 
+> **SOP-label parent gate ([DEV-5378](https://linear.app/verticalint/issue/DEV-5378/), opt-in).** When enabled, `el-linear issues create` requires an
+> issue carrying an **SOP-type label** (any name in `validation.sopLabels`,
+> default `["SOP"]`, case-insensitive) to point at a **parent SOP** — `--parent`
+> or `--related-to` must resolve to another SOP-labeled issue — and **blocks
+> (exit non-zero)** otherwise, naming the rule. An SOP with no parent SOP is
+> unfindable by SOP tooling and breaks the catalog topology. It is **off by
+> default** (`validation.sopLabelParentGate: true` turns it on; the Enrich Layer
+> shared team config flips it on) because "SOP" is a workspace-specific
+> taxonomy, not something an open-source install should assume. Escape hatch:
+> `--allow-unparented-sop` (narrow, for an intentionally top-level SOP);
+> `--skip-validation` also bypasses it but skips all field validation. A typo'd
+> or nonexistent parent reference **blocks** (naming the ref) so a mistake can't
+> orphan an SOP; a transport/service error **fails open** with a warning (and a
+> `fail-open` gate event); a resolvable non-SOP parent hard-blocks.
+
 ```bash
 # --include-closed is required so previously-completed duplicates surface.
 # `issues search` defaults to open states (DEV-4478); the duplicate check

package/dist/commands/issues.js

@@ -3,6 +3,7 @@ import { loadConfig } from "../config/config.js";
 import { enrichProjectResolverError, enrichValidationErrors, } from "../config/error-enrichment.js";
 import { enforceValidation, validateIssueCreation, } from "../config/issue-validation.js";
 import { resolveAssignee, resolveLabels, resolveMemberWithRegistry, resolveTeam, } from "../config/resolver.js";
+import { formatSopParentBlock, getSopLabelGateConfig, hasSopLabel, isUnresolvableReferenceError, } from "../config/sop-label-validation.js";
 import { resolveDefaultStatus } from "../config/status-defaults.js";
 import { enforceTerms } from "../config/term-enforcer.js";
 import { GET_ISSUE_RELATIONS_QUERY, GET_ISSUE_STATE_HISTORY_QUERY, } from "../queries/issues.js";
@@ -544,6 +545,109 @@ async function enforceNoDuplicateIssue(title, options, issuesService) {
     });
     throw new Error(`Issue creation blocked: ${formatDuplicateBlock(matches)}`);
 }
+/**
+ * DEV-5378: create-time SOP-label parent gate. When the issue being created
+ * carries an SOP-type label, require that `--parent` or `--related-to` resolves
+ * to another SOP-labeled issue, and throw otherwise — the deterministic form of
+ * the kaizen skill's Stage-4 rule (parent ALL-1028). An SOP with no parent SOP
+ * is unfindable by `el-sop landscape` and breaks the catalog topology.
+ *
+ * OPT-IN: dormant unless `validation.sopLabelParentGate: true` (see
+ * {@link getSopLabelGateConfig}) — el-linear is MIT/open-source and "SOP" is an
+ * Enrich-Layer-specific taxonomy. Bypassed by `--skip-validation` (blanket) and
+ * the narrow `--allow-unparented-sop` (which records an `overridden` gate event,
+ * mirroring `--allow-duplicate`). The parent-label fetch is best-effort: when a
+ * referenced issue can't be resolved (network / not-found) the gate fails open
+ * with a warning rather than blocking legitimate creation on infra trouble — a
+ * genuinely resolvable non-SOP parent still hard-blocks.
+ */
+async function enforceSopLabelParent(labels, options, issuesService) {
+    if (options.skipValidation) {
+        return;
+    }
+    const { enabled, sopLabels } = getSopLabelGateConfig();
+    if (!enabled) {
+        return;
+    }
+    if (!hasSopLabel(labels, sopLabels)) {
+        return;
+    }
+    const parentRefs = [
+        ...(typeof options.parentTicket === "string" && options.parentTicket
+            ? [options.parentTicket]
+            : []),
+        ...(options.relatedTo ? splitList(options.relatedTo) : []),
+    ];
+    // Record the decision so `el-telemetry gates` can compute override-rate,
+    // mirroring the dup gate (DEV-4834): `overridden` when the caller passed
+    // --allow-unparented-sop and we proceed, `blocked` when we stop creation.
+    const decide = async (reason, unresolvableRefs) => {
+        const gateEvent = { gate: "issues-create-sop-parent" };
+        if (options.allowUnparentedSop) {
+            await emitGateEvent("el-linear", "issues create", {
+                ...gateEvent,
+                outcome: "overridden",
+            });
+            return;
+        }
+        await emitGateEvent("el-linear", "issues create", {
+            ...gateEvent,
+            outcome: "blocked",
+        });
+        throw new Error(`Issue creation blocked: ${formatSopParentBlock({
+            sopLabels,
+            reason,
+            parentRefs,
+            unresolvableRefs,
+        })}`);
+    };
+    // No parent/related at all → deterministic block (no fetch needed).
+    if (parentRefs.length === 0) {
+        await decide("no-parent");
+        return;
+    }
+    // A referenced issue that resolves AND carries an SOP label satisfies the
+    // gate. Fetch per-ref (not batched) so one unresolvable ref doesn't sink a
+    // sibling that would have passed. Classify each failure: a clean
+    // not-found/malformed ref is an unresolvable reference (it contributes to a
+    // block — a typo must not slip through), a transport/service error is infra
+    // trouble (fail open so it can't block legitimate creation).
+    const unresolvableRefs = [];
+    let transportError = false;
+    for (const ref of parentRefs) {
+        try {
+            const issue = await issuesService.getIssueById(ref);
+            if (hasSopLabel(issue.labels.map((l) => l.name), sopLabels)) {
+                return; // valid SOP parent — pass
+            }
+        }
+        catch (err) {
+            if (isUnresolvableReferenceError(err)) {
+                unresolvableRefs.push(ref);
+            }
+            else {
+                transportError = true;
+            }
+        }
+    }
+    // No SOP parent was confirmed. A transport failure may have hidden the real
+    // SOP parent → fail open (best-effort, like the dup gate on a search
+    // failure) and record it so the degradation is measurable (DEV-5378).
+    if (transportError) {
+        await emitGateEvent("el-linear", "issues create", {
+            gate: "issues-create-sop-parent",
+            outcome: "fail-open",
+        });
+        outputWarning(`SOP-parent check could not verify a parent SOP for ${parentRefs.join(", ")} due to a service error; proceeding without blocking.${options.allowUnparentedSop
+            ? ""
+            : " Pass --allow-unparented-sop to silence."}`);
+        return;
+    }
+    // Every reference either resolved to a non-SOP issue or cleanly failed to
+    // resolve (typo / nonexistent) — none is a valid SOP parent → block, naming
+    // any unresolvable refs so a typo reads differently from a real non-SOP parent.
+    await decide("no-sop-parent", unresolvableRefs.length > 0 ? unresolvableRefs : undefined);
+}
 async function handleCreateIssue(title, options, command) {
     const rootOpts = getRootOpts(command);
     const { teamInput, teamId, assigneeId, delegateId, labelIds, status, subscriberIds, priority, } = await resolveCreateInputs(title ?? "", options, rootOpts);
@@ -572,6 +676,15 @@ async function handleCreateIssue(title, options, command) {
     if (title) {
         await enforceNoDuplicateIssue(title, options, issuesService);
     }
+    // DEV-5378: deterministic SOP-label parent gate. Opt-in (dormant unless
+    // validation.sopLabelParentGate). Runs on the post-normalization labels
+    // (resolveCreateInputs rewrote options.labels to the canonical set) and,
+    // when the issue is SOP-labeled, blocks unless --parent/--related-to points
+    // at another SOP-labeled issue. Independent of title, so it runs even on the
+    // --from-template path — though a template that supplies labels server-side
+    // leaves options.labels undefined here, in which case the gate sees no SOP
+    // label and no-ops (same client-side-visibility gap as the dup gate).
+    await enforceSopLabelParent(options.labels ? splitList(options.labels) : [], options, issuesService);
     // Wrap valid issue identifiers as markdown links before creating, so the description
     // saved on Linear has clickable refs from the start. Self-reference can't apply here
     // because the issue doesn't exist yet — pass undefined.
@@ -1137,8 +1250,9 @@ export function setupIssuesCommands(program) {
         .option("--due-date <date>", "due date (YYYY-MM-DD)")
         .option("--checkout", "create and checkout a git branch named after the issue")
         .option("--no-claim", "with --checkout, skip assigning the issue to the current Linear user and moving it to the first started state")
-        .option("--skip-validation", "skip all validation (labels, description, assignee, project, duplicate detection)")
+        .option("--skip-validation", "skip all validation (labels, description, assignee, project, duplicate detection, SOP-parent gate)")
         .option("--allow-duplicate", "skip the duplicate-detection gate and create even if a similar issue already exists")
+        .option("--allow-unparented-sop", "skip the SOP-label parent gate and create an SOP-labeled issue without a parent SOP")
         .option("--no-auto-link", "skip auto-linking issue references found in the description")
         .option("--footer <text>", "text appended to the description (overrides config.messageFooter)")
         .option("--no-footer", "skip the configured messageFooter for this issue")

package/dist/config/config.d.ts

@@ -67,6 +67,21 @@ export interface ElLinearConfig {
          * `DEFAULT_DUPLICATE_THRESHOLD` (0.35). Lower = more aggressive.
          */
         duplicateThreshold?: number;
+        /**
+         * OPT-IN SOP-label parent gate (DEV-5378). When `true`, `issues create`
+         * requires an issue carrying an SOP-type label (see `sopLabels`) to point
+         * at a parent SOP via `--parent` or `--related-to`, blocking otherwise.
+         * Defaults to `false` (dormant) — el-linear is MIT/open-source and "SOP"
+         * is an Enrich-Layer-specific taxonomy, so a fresh install stays silent
+         * until a workspace opts in (the EL shared team config flips it on).
+         * Bypass a single create with `--allow-unparented-sop`.
+         */
+        sopLabelParentGate?: boolean;
+        /**
+         * Label names (matched case-insensitively) that mark an issue as an SOP
+         * for the `sopLabelParentGate` check. Defaults to `["SOP"]`.
+         */
+        sopLabels?: string[];
     };
     /**
      * Optional override for the Linear workspace URL key (the part after

package/dist/config/sop-label-validation.d.ts

@@ -0,0 +1,82 @@
+/**
+ * SOP-label parent validation — DEV-5378.
+ *
+ * The el-linear side of the SOP-system enforcement (parent ALL-1028). When an
+ * issue carries an SOP-type label, it must point at a parent SOP so the
+ * `el-sop landscape` catalog topology stays connected — an SOP with no parent
+ * SOP is unfindable and breaks the tree. This turns the kaizen skill's Stage-4
+ * "always give an SOP issue a parent SOP" prose rule into a deterministic
+ * create-time gate, mirroring the DEV-4823 duplicate-detection gate.
+ *
+ * OPT-IN by design. el-linear is MIT and published on npm; most installs are
+ * not Enrich Layer and have no SOP taxonomy. The gate is dormant unless
+ * `validation.sopLabelParentGate: true` is set (the EL workspace flips it on in
+ * its shared team config). This is the opposite of the duplicate-detection gate,
+ * which defaults on — but the dup check is workspace-agnostic, whereas "SOP" is
+ * an Enrich-Layer-specific label taxonomy that a fresh OSS install must not be
+ * surprised by.
+ */
+/**
+ * Default label names that mark an issue as an SOP. Overridable via
+ * `config.validation.sopLabels`. Matched case-insensitively against the
+ * issue's labels.
+ */
+export declare const DEFAULT_SOP_LABELS: string[];
+export interface SopLabelGateConfig {
+    /**
+     * Whether the gate is active. OPT-IN: only true when validation is not
+     * turned off AND `sopLabelParentGate` is explicitly `true`.
+     */
+    enabled: boolean;
+    /** The SOP label names in effect (config override or {@link DEFAULT_SOP_LABELS}). */
+    sopLabels: string[];
+}
+/**
+ * Resolve the SOP-label-parent-gate config from the merged el-linear config.
+ *
+ * The gate is dormant by default. It activates only when validation isn't
+ * disabled (`validation.enabled !== false`) AND the operator has explicitly set
+ * `validation.sopLabelParentGate: true`. An absent or empty `sopLabels` falls
+ * back to {@link DEFAULT_SOP_LABELS}.
+ */
+export declare function getSopLabelGateConfig(): SopLabelGateConfig;
+/**
+ * Case-insensitive membership test: does `labels` contain any of the configured
+ * SOP label names? Returns false for an empty `labels` set.
+ */
+export declare function hasSopLabel(labels: string[], sopLabels: string[]): boolean;
+/**
+ * Distinguish a reference that cleanly does NOT resolve to a real issue (a
+ * typo'd or nonexistent `--parent` / `--related-to`) from a transport/service
+ * failure (network, GraphQL 5xx, timeout).
+ *
+ * `getIssueById` throws a plain `Error` for both — this codebase has no error
+ * `code` or subclass to switch on — so we key on the two message families it
+ * produces for an *unresolvable reference*:
+ *   - `notFoundError` → `… not found.`  (well-formed ref, no such issue)
+ *   - `parseIssueIdentifier` → `Invalid issue identifier format: …` /
+ *     `Invalid issue number in identifier: …`  (malformed ref)
+ * Everything else — notably `GraphQL request failed: …` / `GraphQL query
+ * failed` from `graphql-service` — is treated as transport and fails open.
+ *
+ * This is a correctness distinction, not just telemetry: an unresolvable
+ * reference must BLOCK. Otherwise a typo'd `--related-to` on an SOP issue fails
+ * open, the issue is created, and the *follow-up* `createRelations` throws —
+ * leaving an orphan SOP on the board (the exact gap DEV-5378 cycle-1 caught). A
+ * transport error must FAIL OPEN so infra trouble can't block legitimate work.
+ */
+export declare function isUnresolvableReferenceError(err: unknown): boolean;
+/**
+ * Render the human/agent-facing block thrown when an SOP-labeled issue has no
+ * SOP parent. `reason` distinguishes "no parent at all" from "one or more
+ * references present but none resolves to an SOP-labeled issue", so the message
+ * points at the exact fix. When some references couldn't be resolved at all,
+ * `unresolvableRefs` names them (a typo'd ref reads differently from a real but
+ * non-SOP parent). Names the rule and the `--allow-unparented-sop` escape hatch.
+ */
+export declare function formatSopParentBlock(opts: {
+    sopLabels: string[];
+    reason: "no-parent" | "no-sop-parent";
+    parentRefs: string[];
+    unresolvableRefs?: string[];
+}): string;

package/dist/config/sop-label-validation.js

@@ -0,0 +1,103 @@
+/**
+ * SOP-label parent validation — DEV-5378.
+ *
+ * The el-linear side of the SOP-system enforcement (parent ALL-1028). When an
+ * issue carries an SOP-type label, it must point at a parent SOP so the
+ * `el-sop landscape` catalog topology stays connected — an SOP with no parent
+ * SOP is unfindable and breaks the tree. This turns the kaizen skill's Stage-4
+ * "always give an SOP issue a parent SOP" prose rule into a deterministic
+ * create-time gate, mirroring the DEV-4823 duplicate-detection gate.
+ *
+ * OPT-IN by design. el-linear is MIT and published on npm; most installs are
+ * not Enrich Layer and have no SOP taxonomy. The gate is dormant unless
+ * `validation.sopLabelParentGate: true` is set (the EL workspace flips it on in
+ * its shared team config). This is the opposite of the duplicate-detection gate,
+ * which defaults on — but the dup check is workspace-agnostic, whereas "SOP" is
+ * an Enrich-Layer-specific label taxonomy that a fresh OSS install must not be
+ * surprised by.
+ */
+import { loadConfig } from "./config.js";
+/**
+ * Default label names that mark an issue as an SOP. Overridable via
+ * `config.validation.sopLabels`. Matched case-insensitively against the
+ * issue's labels.
+ */
+export const DEFAULT_SOP_LABELS = ["SOP"];
+/**
+ * Resolve the SOP-label-parent-gate config from the merged el-linear config.
+ *
+ * The gate is dormant by default. It activates only when validation isn't
+ * disabled (`validation.enabled !== false`) AND the operator has explicitly set
+ * `validation.sopLabelParentGate: true`. An absent or empty `sopLabels` falls
+ * back to {@link DEFAULT_SOP_LABELS}.
+ */
+export function getSopLabelGateConfig() {
+    const validation = loadConfig().validation;
+    const enabled = validation?.enabled !== false && validation?.sopLabelParentGate === true;
+    const sopLabels = validation?.sopLabels && validation.sopLabels.length > 0
+        ? validation.sopLabels
+        : DEFAULT_SOP_LABELS;
+    return { enabled, sopLabels };
+}
+/**
+ * Case-insensitive membership test: does `labels` contain any of the configured
+ * SOP label names? Returns false for an empty `labels` set.
+ */
+export function hasSopLabel(labels, sopLabels) {
+    const wanted = new Set(sopLabels.map((l) => l.toLowerCase()));
+    return labels.some((l) => wanted.has(l.toLowerCase()));
+}
+/**
+ * Distinguish a reference that cleanly does NOT resolve to a real issue (a
+ * typo'd or nonexistent `--parent` / `--related-to`) from a transport/service
+ * failure (network, GraphQL 5xx, timeout).
+ *
+ * `getIssueById` throws a plain `Error` for both — this codebase has no error
+ * `code` or subclass to switch on — so we key on the two message families it
+ * produces for an *unresolvable reference*:
+ *   - `notFoundError` → `… not found.`  (well-formed ref, no such issue)
+ *   - `parseIssueIdentifier` → `Invalid issue identifier format: …` /
+ *     `Invalid issue number in identifier: …`  (malformed ref)
+ * Everything else — notably `GraphQL request failed: …` / `GraphQL query
+ * failed` from `graphql-service` — is treated as transport and fails open.
+ *
+ * This is a correctness distinction, not just telemetry: an unresolvable
+ * reference must BLOCK. Otherwise a typo'd `--related-to` on an SOP issue fails
+ * open, the issue is created, and the *follow-up* `createRelations` throws —
+ * leaving an orphan SOP on the board (the exact gap DEV-5378 cycle-1 caught). A
+ * transport error must FAIL OPEN so infra trouble can't block legitimate work.
+ */
+export function isUnresolvableReferenceError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return (message.includes("not found.") ||
+        message.includes("Invalid issue identifier format") ||
+        message.includes("Invalid issue number in identifier"));
+}
+/**
+ * Render the human/agent-facing block thrown when an SOP-labeled issue has no
+ * SOP parent. `reason` distinguishes "no parent at all" from "one or more
+ * references present but none resolves to an SOP-labeled issue", so the message
+ * points at the exact fix. When some references couldn't be resolved at all,
+ * `unresolvableRefs` names them (a typo'd ref reads differently from a real but
+ * non-SOP parent). Names the rule and the `--allow-unparented-sop` escape hatch.
+ */
+export function formatSopParentBlock(opts) {
+    const sopList = opts.sopLabels.join(", ");
+    const head = `SOP-labeled issue must point at a parent SOP (SOP label(s): ${sopList}).\n` +
+        "  An SOP with no parent SOP is unfindable by `el-sop landscape` and breaks the catalog topology.\n";
+    let detail;
+    if (opts.reason === "no-parent") {
+        detail =
+            "  This issue has no --parent or --related-to. Add one that points at an SOP-labeled issue.\n";
+    }
+    else {
+        detail = `  No referenced issue resolves to an SOP-labeled issue (referenced: ${opts.parentRefs.join(", ")}).\n`;
+        if (opts.unresolvableRefs && opts.unresolvableRefs.length > 0) {
+            detail += `  Could not resolve: ${opts.unresolvableRefs.join(", ")} — check the identifier exists.\n`;
+        }
+        detail +=
+            "  Point --parent or --related-to at an existing SOP-labeled issue.\n";
+    }
+    const hatch = "  If this SOP is intentionally top-level, re-run with --allow-unparented-sop.";
+    return head + detail + hatch;
+}

package/dist/utils/gate-telemetry.d.ts

@@ -25,7 +25,13 @@ export declare function decideGateLedger(opts: {
 export interface GateEvent {
     /** Stable gate id, e.g. `issues-create-dup`. */
     gate: string;
-    outcome: "blocked" | "overridden";
+    /**
+     * `blocked` — the gate stopped creation. `overridden` — a gate-specific
+     * override flag let a would-block proceed. `fail-open` — the gate could not
+     * evaluate (infra/service error) and let creation proceed rather than block
+     * on trouble; tracked so degradation is measurable (DEV-5378).
+     */
+    outcome: "blocked" | "overridden" | "fail-open";
     /** Highest candidate similarity that triggered the gate (0–1). */
     topScore?: number;
     /** How many candidates crossed the threshold. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enrichlayer/el-linear",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "description": "A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.",
   "main": "dist/main.js",
   "types": "dist/main.d.ts",