@orderful/droid 0.43.0 → 0.44.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @orderful/droid
 
+## 0.44.1
+
+### Patch Changes
+
+- [#258](https://github.com/Orderful/droid/pull/258) [`2e19bbd`](https://github.com/Orderful/droid/commit/2e19bbda7146847836ccda028e1c6bf802a5215e) Thanks [@frytyler](https://github.com/frytyler)! - Add lock/unlock commands to release tool. Requires branch-lock.yml GitHub Action deployed to target repos.
+
+## 0.44.0
+
+### Minor Changes
+
+- [#259](https://github.com/Orderful/droid/pull/259) [`f64bab2`](https://github.com/Orderful/droid/commit/f64bab250e25bb57ad9c1c2ac50246455a18eb42) Thanks [@frytyler](https://github.com/frytyler)! - Add /release merge command to merge release PRs when all checks pass and notify Slack. Fix release notes generation to compare branches instead of listing all historically merged PRs.
+
 ## 0.43.0
 
 ### Minor Changes

package/dist/tools/release/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "droid-release",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Release ceremony automation — create release PRs, check status, notify Slack.",
   "author": {
     "name": "Orderful",

package/dist/tools/release/TOOL.yaml

@@ -1,6 +1,6 @@
 name: release
 description: "Release ceremony automation — create release PRs, check status, notify Slack."
-version: 0.1.0
+version: 0.2.0
 status: alpha
 
 includes:
@@ -18,4 +18,4 @@ config_schema:
   slack_channel:
     type: string
     description: "Slack channel for release notifications"
-    default: "#release-management"
+    default: "#release_management"

package/dist/tools/release/commands/release.md

@@ -1,7 +1,7 @@
 ---
 name: release
-description: "Release ceremony automation"
-argument-hint: "[start [repo] | status | complete [repo]]"
+description: "Release ceremony automation and branch locking"
+argument-hint: "[start [repo] [--no-lock] | merge [repo] | lock [repo] | unlock [repo] | status | complete [repo]]"
 ---
 
 # /release
@@ -12,17 +12,25 @@ argument-hint: "[start [repo] | status | complete [repo]]"
 
 ## Examples
 
-- `/release start` → Create release PR for current repo
+- `/release start` → Create release PR + auto-lock branch
 - `/release start orderful-workspace` → Create release PR for a specific repo
-- `/release status` → Check CI state across release repos
-- `/release complete` → Post "release complete" to Slack
+- `/release start --no-lock` → Create release PR without locking
+- `/release merge` → Merge release PR (checks must be green)
+- `/release lock` → Manually lock the release branch
+- `/release unlock` → Unlock the release branch
+- `/release status` → Check CI and lock state across release repos
+- `/release complete` → Post "release complete" to Slack, auto-unlock if locked
 
 ## Quick Reference
 
 ```
-/release start [repo]       # Create release PR + notify Slack
-/release status             # CI state across repos
-/release complete [repo]    # Notify Slack, close out release
+/release start [repo]        # Create release PR + auto-lock + notify Slack
+/release start --no-lock    # Create release PR without locking
+/release merge [repo]       # Merge release PR (checks must pass)
+/release lock [repo]        # Manually lock release branch
+/release unlock [repo]      # Unlock release branch
+/release status             # CI + lock state across repos
+/release complete [repo]    # Notify Slack + auto-unlock
 ```
 
 See the **release skill** for complete documentation.

package/dist/tools/release/skills/release/SKILL.md

@@ -1,20 +1,21 @@
 ---
 name: release
-description: "Release ceremony automation for dev-to-master releases. Use when starting a release, checking release status, or completing a release. User prompts like 'start a release', 'release status', 'release complete'."
-argument-hint: "[start [repo] | status | complete [repo]]"
+description: "Release ceremony automation for dev-to-master releases. Use when starting a release, merging a release, locking a branch, checking release status, or completing a release. User prompts like 'start a release', 'merge the release', 'lock dev', 'release status', 'unlock the branch'."
+argument-hint: "[start [repo] | merge [repo] | lock [repo] | unlock [repo] | status | complete [repo]]"
 allowed-tools: [Read, Write, Glob, Grep, Bash, Edit]
 ---
 
 # Release Skill
 
-Automate dev → master release ceremonies: create release PRs, notify Slack, and track status.
+Automate dev → master release ceremonies: create release PRs, lock branches during CI, notify Slack, and track status.
 
 ## When to Use
 
 - User wants to start a release (create PR from dev → master)
-- User asks about release status (open PRs, CI checks)
+- User wants to lock or unlock a branch during a release
+- User asks about release status (open PRs, lock state, CI checks)
 - User says "release complete" or wants to close out a release
-- Natural language like "start a release", "what's the release status?"
+- Natural language like "start a release", "lock dev", "what's the release status?"
 
 ## When NOT to Use
 
@@ -26,6 +27,7 @@ Automate dev → master release ceremonies: create release PRs, notify Slack, an
 
 1. **`gh` CLI** — authenticated with access to target repos
 2. **Slack integration** — `droid integrations slack post` configured (optional, falls back to terminal)
+3. **`branch-lock.yml`** — GitHub Action deployed to target repo (required for auto-lock on start + lock/unlock commands)
 
 ## Configuration
 
@@ -37,7 +39,7 @@ droid config --get repos
 ```
 
 - **Repos:** Filter `repos` array for entries with `release_branch` set — these are release repos
-- **Slack channel:** From `tools.release.slack_channel` (default: `#release-management`)
+- **Slack channel:** From `tools.release.slack_channel` (default: `#release_management`)
 - **Repo detection:** Match cwd against repo paths, or ask user if ambiguous
 
 If no repos have `release_branch` set, tell user:
@@ -47,9 +49,12 @@ If no repos have `release_branch` set, tell user:
 
 | Command | Action |
 |---------|--------|
-| `/release start [repo]` | Create release PR + notify Slack |
-| `/release status` | Check open release PRs + CI state |
-| `/release complete [repo]` | Post completion to Slack |
+| `/release start [repo] [--no-lock]` | Create release PR + auto-lock branch + notify Slack |
+| `/release merge [repo]` | Merge release PR (only if checks pass) + notify Slack |
+| `/release lock [repo]` | Lock release branch (confirms first) |
+| `/release unlock [repo]` | Unlock release branch |
+| `/release status` | Check open release PRs + CI state + lock state |
+| `/release complete [repo]` | Post completion to Slack + auto-unlock |
 
 See `references/workflows.md` for detailed step-by-step procedures and exact `gh` commands.
 
@@ -68,6 +73,8 @@ See `references/templates.md` for Slack message and PR body templates.
 |-------|--------|
 | No release repos configured | Suggest `droid repos add` with release branch |
 | `gh` CLI not authenticated | Suggest `gh auth login` |
+| `branch-lock.yml` not found in repo | Tell user to add the `branch-lock.yml` workflow to the repo |
 | Slack not configured | Print message to terminal, suggest `droid integrations setup slack` |
+| Branch already locked | Warn user, offer to unlock first |
 | Release PR already exists | Show existing PR, ask if user wants to proceed |
 | CI checks failing | Show status, do not auto-merge |

package/dist/tools/release/skills/release/references/templates.md

@@ -6,24 +6,60 @@ Slack mrkdwn and PR body templates for release notifications.
 
 All Slack messages are posted via `droid integrations slack post`. Format as Slack mrkdwn (not GitHub markdown).
 
-### Release Started
+### Release Open for Review
 
 ```
-:rocket: *Release started — {repo_name}*
+:rocket: *Release open for review — {repo_name}*
 
 *Risk:* {risk_emoji} {risk_level}
 *PR:* <{pr_url}|#{pr_number}>
 *Branch:* `{release_branch}` → `{production_branch}`
+:lock: `{release_branch}` is locked — no merges until release completes
 
 {pr_summary}
 
 Posted with :droid:
 ```
 
+If `--no-lock` was used, omit the lock line.
+
 Risk emojis:
 - Low Risk: `:large_green_circle:`
 - High Risk: `:warning:`
 
+### Release Merged
+
+```
+:merged-pr: *Release merged — {repo_name}*
+
+*PR:* <{pr_url}|#{pr_number}>
+*Branch:* `{release_branch}` → `{production_branch}`
+
+Monitoring deployment :eyes:
+
+Posted with :droid:
+```
+
+### Branch Locked
+
+```
+:lock: *Branch locked — {repo_name}*
+
+`{branch}` is now read-only. No merges until unlocked.
+
+Posted with :droid:
+```
+
+### Branch Unlocked
+
+```
+:unlock: *Branch unlocked — {repo_name}*
+
+`{branch}` is open for merges.
+
+Posted with :droid:
+```
+
 ### Release Complete
 
 ```
@@ -35,6 +71,11 @@ Risk emojis:
 Posted with :droid:
 ```
 
+If auto-unlocked, append:
+```
+:unlock: Auto-unlocked `{release_branch}`
+```
+
 ---
 
 ## Release PR Body
@@ -68,12 +109,35 @@ Where `{pr_list}` is a bulleted list of merged PRs:
 
 When Slack is not configured, print a plain-text version to terminal:
 
-### Release Started (terminal)
+### Release Open for Review (terminal)
 ```
-Release started — {repo_name}
+Release open for review — {repo_name}
   Risk: {risk_level}
   PR:   {pr_url}
   Branch: {release_branch} -> {production_branch}
+  Lock: {release_branch} locked (no merges until release completes)
+```
+
+If `--no-lock` was used, omit the Lock line.
+
+### Release Merged (terminal)
+```
+Release merged — {repo_name}
+  PR:     {pr_url}
+  Branch: {release_branch} -> {production_branch}
+  Monitoring deployment...
+```
+
+### Branch Locked (terminal)
+```
+Branch locked — {repo_name}
+  {branch} is now read-only
+```
+
+### Branch Unlocked (terminal)
+```
+Branch unlocked — {repo_name}
+  {branch} is open for merges
 ```
 
 ### Release Complete (terminal)

package/dist/tools/release/skills/release/references/workflows.md

@@ -7,8 +7,8 @@ Detailed step-by-step procedures for each `/release` subcommand. All commands us
 ```bash
 # 1. Read config
 SLACK_CHANNEL=$(droid config --get tools.release.slack_channel)
-# Default to #release-management if not set
-SLACK_CHANNEL="${SLACK_CHANNEL:-#release-management}"
+# Default to #release_management if not set
+SLACK_CHANNEL="${SLACK_CHANNEL:-#release_management}"
 
 # 2. Get repos and filter for release repos (those with release_branch set)
 droid config --get repos
@@ -25,9 +25,11 @@ git -C {repo_path} remote get-url origin
 
 ---
 
-## `/release start [repo]`
+## `/release start [repo] [--no-lock]`
 
-Create a release PR and notify Slack.
+Create a release PR, auto-lock the release branch, and notify Slack.
+
+**Auto-lock is on by default.** The branch is locked immediately after the PR is created to prevent blind merges during CI. Pass `--no-lock` (or natural language like "start without locking") to skip.
 
 ### Steps
 
@@ -39,11 +41,14 @@ Create a release PR and notify Slack.
    ```
    If one exists, show it and ask: "A release PR already exists. Open it instead?"
 
-3. **Generate release notes** — list PRs merged to the release branch since last release:
+3. **Generate release notes** — compare branches to find PRs included in this release:
    ```bash
-   gh pr list --base {release_branch} --state merged --json number,title,author --limit 50 --repo {owner}/{repo}
+   # Get commits in release_branch that aren't in production_branch
+   gh api repos/{owner}/{repo}/compare/{production_branch}...{release_branch} --jq '.commits[].commit.message'
    ```
-   Format as a bulleted list for the PR body.
+   Extract PR numbers from commit messages (e.g. `(#1234)`) and format as a bulleted list for the PR body.
+
+   **Do NOT use** `gh pr list --base {release_branch} --state merged` — that returns ALL historically merged PRs, not just the ones since the last release.
 
 4. **Ask risk level** — use AskUserQuestion:
    - Low Risk (routine release, no breaking changes)
@@ -61,7 +66,22 @@ Create a release PR and notify Slack.
    ```
    See `templates.md` for the PR body template.
 
-6. **Post to Slack:**
+6. **Auto-lock branch** (unless `--no-lock`):
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=lock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+   Verify lock applied:
+   ```bash
+   sleep 5
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled'
+   ```
+   If `branch-lock.yml` is not found in the repo, warn but don't fail:
+   "Could not auto-lock — `branch-lock.yml` not found in `{repo_name}`. Use `/release lock` manually after adding the workflow."
+
+7. **Post to Slack:**
    ```bash
    node -e 'process.stdout.write(JSON.stringify({
      channel: "{slack_channel}",
@@ -69,9 +89,118 @@ Create a release PR and notify Slack.
      unfurl_links: false
    }))' | droid integrations slack post
    ```
-   See `templates.md` for the Slack message template (release started).
+   See `templates.md` for the Slack message template (release open for review — includes lock status).
+
+8. **Confirm to user** — show PR URL, lock status, and Slack post confirmation.
+
+---
+
+## `/release merge [repo]`
+
+Merge the release PR if all checks are green, then notify Slack.
+
+### Steps
+
+1. **Detect repo** — match cwd or ask user
+
+2. **Find the open release PR:**
+   ```bash
+   gh pr list --search "[RELEASE]" --state open --base {production_branch} --head {release_branch} --json number,title,url,statusCheckRollup --repo {owner}/{repo}
+   ```
+   If no open release PR found, error: "No open release PR found. Run `/release start` first."
 
-7. **Confirm to user** — show PR URL and Slack post confirmation.
+3. **Check all status checks:**
+   Parse `statusCheckRollup` from the PR data. Every check must have `conclusion: "SUCCESS"` or `state: "SUCCESS"`.
+
+   If any checks are pending: "CI checks are still running on PR #{number}. Wait for them to finish."
+   If any checks are failing: "CI checks are failing on PR #{number}. Fix them before merging." Show the failing checks.
+
+4. **Confirm with user** — use AskUserQuestion:
+   "All checks are green on PR #{number}. Merge `{release_branch}` → `{production_branch}`?"
+
+5. **Merge the PR:**
+   ```bash
+   gh pr merge {pr_number} --merge --repo {owner}/{repo}
+   ```
+
+6. **Post to Slack** — release merged notification (see `templates.md`).
+
+7. **Confirm to user** — show merge confirmation and Slack post confirmation.
+
+---
+
+## `/release lock [repo]`
+
+Manually lock the release branch. Use when you need to lock outside of `/release start` (which auto-locks).
+
+### Steps
+
+1. **Detect repo** — match cwd or ask user
+
+2. **Check current lock state:**
+   ```bash
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false'
+   ```
+   If already locked, warn: "Branch `{release_branch}` is already locked. Unlock first?"
+
+3. **Confirm with user** — use AskUserQuestion:
+   "Lock `{release_branch}` on `{repo_name}`? No one will be able to merge until unlocked."
+
+4. **Trigger the lock Action:**
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=lock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+
+5. **Verify lock applied** (wait a few seconds, then check):
+   ```bash
+   sleep 5
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled'
+   ```
+   If still not locked, check the workflow run status:
+   ```bash
+   gh run list --workflow=branch-lock.yml --limit 1 --json status,conclusion --repo {owner}/{repo}
+   ```
+
+6. **Post to Slack** — lock notification (see `templates.md`).
+
+7. **Confirm to user** — "Locked `{release_branch}` on `{repo_name}`."
+
+---
+
+## `/release unlock [repo]`
+
+Unlock the release branch.
+
+### Steps
+
+1. **Detect repo** — match cwd or ask user
+
+2. **Check current lock state:**
+   ```bash
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false'
+   ```
+   If not locked, inform: "Branch `{release_branch}` is not currently locked."
+
+3. **Trigger the unlock Action:**
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=unlock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+
+4. **Verify unlock applied:**
+   ```bash
+   sleep 5
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled'
+   ```
+
+5. **Post to Slack** — unlock notification (see `templates.md`).
+
+6. **Confirm to user** — "Unlocked `{release_branch}` on `{repo_name}`."
 
 ---
 
@@ -90,11 +219,17 @@ Check release status across all configured release repos.
    gh pr list --search "[RELEASE]" --state open --json number,title,url,statusCheckRollup --repo {owner}/{repo}
    ```
 
+   **Lock state:**
+   ```bash
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false'
+   ```
+
 3. **Format and display** as a summary:
 
    ```
    {repo_name}
      Release PR: #{number} — {CI status} (green/pending/failing)
+     Branch lock: {release_branch} — locked/unlocked
    ```
 
    If no open release PR: "No active release"
@@ -104,7 +239,7 @@ Check release status across all configured release repos.
 
 ## `/release complete [repo]`
 
-Close out a release — notify Slack.
+Close out a release — notify Slack and auto-unlock.
 
 ### Steps
 
@@ -124,6 +259,20 @@ Close out a release — notify Slack.
 
 3. **Post to Slack** — release complete notification (see `templates.md`).
 
-4. **Confirm to user:**
+4. **Auto-unlock if locked:**
+   ```bash
+   LOCKED=$(gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false')
+   ```
+   If locked, trigger unlock:
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=unlock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+   Post unlock notification to Slack as well.
+
+5. **Confirm to user:**
    - "Release complete for `{repo_name}`"
+   - "Auto-unlocked `{release_branch}`" (if was locked)
    - Show Slack message confirmation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orderful/droid",
-  "version": "0.43.0",
+  "version": "0.44.1",
   "description": "AI workflow toolkit for sharing skills, commands, and agents across the team",
   "type": "module",
   "bin": {

package/src/tools/release/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "droid-release",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Release ceremony automation — create release PRs, check status, notify Slack.",
   "author": {
     "name": "Orderful",

package/src/tools/release/TOOL.yaml

@@ -1,6 +1,6 @@
 name: release
 description: "Release ceremony automation — create release PRs, check status, notify Slack."
-version: 0.1.0
+version: 0.2.0
 status: alpha
 
 includes:
@@ -18,4 +18,4 @@ config_schema:
   slack_channel:
     type: string
     description: "Slack channel for release notifications"
-    default: "#release-management"
+    default: "#release_management"

package/src/tools/release/commands/release.md

@@ -1,7 +1,7 @@
 ---
 name: release
-description: "Release ceremony automation"
-argument-hint: "[start [repo] | status | complete [repo]]"
+description: "Release ceremony automation and branch locking"
+argument-hint: "[start [repo] [--no-lock] | merge [repo] | lock [repo] | unlock [repo] | status | complete [repo]]"
 ---
 
 # /release
@@ -12,17 +12,25 @@ argument-hint: "[start [repo] | status | complete [repo]]"
 
 ## Examples
 
-- `/release start` → Create release PR for current repo
+- `/release start` → Create release PR + auto-lock branch
 - `/release start orderful-workspace` → Create release PR for a specific repo
-- `/release status` → Check CI state across release repos
-- `/release complete` → Post "release complete" to Slack
+- `/release start --no-lock` → Create release PR without locking
+- `/release merge` → Merge release PR (checks must be green)
+- `/release lock` → Manually lock the release branch
+- `/release unlock` → Unlock the release branch
+- `/release status` → Check CI and lock state across release repos
+- `/release complete` → Post "release complete" to Slack, auto-unlock if locked
 
 ## Quick Reference
 
 ```
-/release start [repo]       # Create release PR + notify Slack
-/release status             # CI state across repos
-/release complete [repo]    # Notify Slack, close out release
+/release start [repo]        # Create release PR + auto-lock + notify Slack
+/release start --no-lock    # Create release PR without locking
+/release merge [repo]       # Merge release PR (checks must pass)
+/release lock [repo]        # Manually lock release branch
+/release unlock [repo]      # Unlock release branch
+/release status             # CI + lock state across repos
+/release complete [repo]    # Notify Slack + auto-unlock
 ```
 
 See the **release skill** for complete documentation.

package/src/tools/release/skills/release/SKILL.md

@@ -1,20 +1,21 @@
 ---
 name: release
-description: "Release ceremony automation for dev-to-master releases. Use when starting a release, checking release status, or completing a release. User prompts like 'start a release', 'release status', 'release complete'."
-argument-hint: "[start [repo] | status | complete [repo]]"
+description: "Release ceremony automation for dev-to-master releases. Use when starting a release, merging a release, locking a branch, checking release status, or completing a release. User prompts like 'start a release', 'merge the release', 'lock dev', 'release status', 'unlock the branch'."
+argument-hint: "[start [repo] | merge [repo] | lock [repo] | unlock [repo] | status | complete [repo]]"
 allowed-tools: [Read, Write, Glob, Grep, Bash, Edit]
 ---
 
 # Release Skill
 
-Automate dev → master release ceremonies: create release PRs, notify Slack, and track status.
+Automate dev → master release ceremonies: create release PRs, lock branches during CI, notify Slack, and track status.
 
 ## When to Use
 
 - User wants to start a release (create PR from dev → master)
-- User asks about release status (open PRs, CI checks)
+- User wants to lock or unlock a branch during a release
+- User asks about release status (open PRs, lock state, CI checks)
 - User says "release complete" or wants to close out a release
-- Natural language like "start a release", "what's the release status?"
+- Natural language like "start a release", "lock dev", "what's the release status?"
 
 ## When NOT to Use
 
@@ -26,6 +27,7 @@ Automate dev → master release ceremonies: create release PRs, notify Slack, an
 
 1. **`gh` CLI** — authenticated with access to target repos
 2. **Slack integration** — `droid integrations slack post` configured (optional, falls back to terminal)
+3. **`branch-lock.yml`** — GitHub Action deployed to target repo (required for auto-lock on start + lock/unlock commands)
 
 ## Configuration
 
@@ -37,7 +39,7 @@ droid config --get repos
 ```
 
 - **Repos:** Filter `repos` array for entries with `release_branch` set — these are release repos
-- **Slack channel:** From `tools.release.slack_channel` (default: `#release-management`)
+- **Slack channel:** From `tools.release.slack_channel` (default: `#release_management`)
 - **Repo detection:** Match cwd against repo paths, or ask user if ambiguous
 
 If no repos have `release_branch` set, tell user:
@@ -47,9 +49,12 @@ If no repos have `release_branch` set, tell user:
 
 | Command | Action |
 |---------|--------|
-| `/release start [repo]` | Create release PR + notify Slack |
-| `/release status` | Check open release PRs + CI state |
-| `/release complete [repo]` | Post completion to Slack |
+| `/release start [repo] [--no-lock]` | Create release PR + auto-lock branch + notify Slack |
+| `/release merge [repo]` | Merge release PR (only if checks pass) + notify Slack |
+| `/release lock [repo]` | Lock release branch (confirms first) |
+| `/release unlock [repo]` | Unlock release branch |
+| `/release status` | Check open release PRs + CI state + lock state |
+| `/release complete [repo]` | Post completion to Slack + auto-unlock |
 
 See `references/workflows.md` for detailed step-by-step procedures and exact `gh` commands.
 
@@ -68,6 +73,8 @@ See `references/templates.md` for Slack message and PR body templates.
 |-------|--------|
 | No release repos configured | Suggest `droid repos add` with release branch |
 | `gh` CLI not authenticated | Suggest `gh auth login` |
+| `branch-lock.yml` not found in repo | Tell user to add the `branch-lock.yml` workflow to the repo |
 | Slack not configured | Print message to terminal, suggest `droid integrations setup slack` |
+| Branch already locked | Warn user, offer to unlock first |
 | Release PR already exists | Show existing PR, ask if user wants to proceed |
 | CI checks failing | Show status, do not auto-merge |

package/src/tools/release/skills/release/references/templates.md

@@ -6,24 +6,60 @@ Slack mrkdwn and PR body templates for release notifications.
 
 All Slack messages are posted via `droid integrations slack post`. Format as Slack mrkdwn (not GitHub markdown).
 
-### Release Started
+### Release Open for Review
 
 ```
-:rocket: *Release started — {repo_name}*
+:rocket: *Release open for review — {repo_name}*
 
 *Risk:* {risk_emoji} {risk_level}
 *PR:* <{pr_url}|#{pr_number}>
 *Branch:* `{release_branch}` → `{production_branch}`
+:lock: `{release_branch}` is locked — no merges until release completes
 
 {pr_summary}
 
 Posted with :droid:
 ```
 
+If `--no-lock` was used, omit the lock line.
+
 Risk emojis:
 - Low Risk: `:large_green_circle:`
 - High Risk: `:warning:`
 
+### Release Merged
+
+```
+:merged-pr: *Release merged — {repo_name}*
+
+*PR:* <{pr_url}|#{pr_number}>
+*Branch:* `{release_branch}` → `{production_branch}`
+
+Monitoring deployment :eyes:
+
+Posted with :droid:
+```
+
+### Branch Locked
+
+```
+:lock: *Branch locked — {repo_name}*
+
+`{branch}` is now read-only. No merges until unlocked.
+
+Posted with :droid:
+```
+
+### Branch Unlocked
+
+```
+:unlock: *Branch unlocked — {repo_name}*
+
+`{branch}` is open for merges.
+
+Posted with :droid:
+```
+
 ### Release Complete
 
 ```
@@ -35,6 +71,11 @@ Risk emojis:
 Posted with :droid:
 ```
 
+If auto-unlocked, append:
+```
+:unlock: Auto-unlocked `{release_branch}`
+```
+
 ---
 
 ## Release PR Body
@@ -68,12 +109,35 @@ Where `{pr_list}` is a bulleted list of merged PRs:
 
 When Slack is not configured, print a plain-text version to terminal:
 
-### Release Started (terminal)
+### Release Open for Review (terminal)
 ```
-Release started — {repo_name}
+Release open for review — {repo_name}
   Risk: {risk_level}
   PR:   {pr_url}
   Branch: {release_branch} -> {production_branch}
+  Lock: {release_branch} locked (no merges until release completes)
+```
+
+If `--no-lock` was used, omit the Lock line.
+
+### Release Merged (terminal)
+```
+Release merged — {repo_name}
+  PR:     {pr_url}
+  Branch: {release_branch} -> {production_branch}
+  Monitoring deployment...
+```
+
+### Branch Locked (terminal)
+```
+Branch locked — {repo_name}
+  {branch} is now read-only
+```
+
+### Branch Unlocked (terminal)
+```
+Branch unlocked — {repo_name}
+  {branch} is open for merges
 ```
 
 ### Release Complete (terminal)

package/src/tools/release/skills/release/references/workflows.md

@@ -7,8 +7,8 @@ Detailed step-by-step procedures for each `/release` subcommand. All commands us
 ```bash
 # 1. Read config
 SLACK_CHANNEL=$(droid config --get tools.release.slack_channel)
-# Default to #release-management if not set
-SLACK_CHANNEL="${SLACK_CHANNEL:-#release-management}"
+# Default to #release_management if not set
+SLACK_CHANNEL="${SLACK_CHANNEL:-#release_management}"
 
 # 2. Get repos and filter for release repos (those with release_branch set)
 droid config --get repos
@@ -25,9 +25,11 @@ git -C {repo_path} remote get-url origin
 
 ---
 
-## `/release start [repo]`
+## `/release start [repo] [--no-lock]`
 
-Create a release PR and notify Slack.
+Create a release PR, auto-lock the release branch, and notify Slack.
+
+**Auto-lock is on by default.** The branch is locked immediately after the PR is created to prevent blind merges during CI. Pass `--no-lock` (or natural language like "start without locking") to skip.
 
 ### Steps
 
@@ -39,11 +41,14 @@ Create a release PR and notify Slack.
    ```
    If one exists, show it and ask: "A release PR already exists. Open it instead?"
 
-3. **Generate release notes** — list PRs merged to the release branch since last release:
+3. **Generate release notes** — compare branches to find PRs included in this release:
    ```bash
-   gh pr list --base {release_branch} --state merged --json number,title,author --limit 50 --repo {owner}/{repo}
+   # Get commits in release_branch that aren't in production_branch
+   gh api repos/{owner}/{repo}/compare/{production_branch}...{release_branch} --jq '.commits[].commit.message'
    ```
-   Format as a bulleted list for the PR body.
+   Extract PR numbers from commit messages (e.g. `(#1234)`) and format as a bulleted list for the PR body.
+
+   **Do NOT use** `gh pr list --base {release_branch} --state merged` — that returns ALL historically merged PRs, not just the ones since the last release.
 
 4. **Ask risk level** — use AskUserQuestion:
    - Low Risk (routine release, no breaking changes)
@@ -61,7 +66,22 @@ Create a release PR and notify Slack.
    ```
    See `templates.md` for the PR body template.
 
-6. **Post to Slack:**
+6. **Auto-lock branch** (unless `--no-lock`):
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=lock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+   Verify lock applied:
+   ```bash
+   sleep 5
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled'
+   ```
+   If `branch-lock.yml` is not found in the repo, warn but don't fail:
+   "Could not auto-lock — `branch-lock.yml` not found in `{repo_name}`. Use `/release lock` manually after adding the workflow."
+
+7. **Post to Slack:**
    ```bash
    node -e 'process.stdout.write(JSON.stringify({
      channel: "{slack_channel}",
@@ -69,9 +89,118 @@ Create a release PR and notify Slack.
      unfurl_links: false
    }))' | droid integrations slack post
    ```
-   See `templates.md` for the Slack message template (release started).
+   See `templates.md` for the Slack message template (release open for review — includes lock status).
+
+8. **Confirm to user** — show PR URL, lock status, and Slack post confirmation.
+
+---
+
+## `/release merge [repo]`
+
+Merge the release PR if all checks are green, then notify Slack.
+
+### Steps
+
+1. **Detect repo** — match cwd or ask user
+
+2. **Find the open release PR:**
+   ```bash
+   gh pr list --search "[RELEASE]" --state open --base {production_branch} --head {release_branch} --json number,title,url,statusCheckRollup --repo {owner}/{repo}
+   ```
+   If no open release PR found, error: "No open release PR found. Run `/release start` first."
 
-7. **Confirm to user** — show PR URL and Slack post confirmation.
+3. **Check all status checks:**
+   Parse `statusCheckRollup` from the PR data. Every check must have `conclusion: "SUCCESS"` or `state: "SUCCESS"`.
+
+   If any checks are pending: "CI checks are still running on PR #{number}. Wait for them to finish."
+   If any checks are failing: "CI checks are failing on PR #{number}. Fix them before merging." Show the failing checks.
+
+4. **Confirm with user** — use AskUserQuestion:
+   "All checks are green on PR #{number}. Merge `{release_branch}` → `{production_branch}`?"
+
+5. **Merge the PR:**
+   ```bash
+   gh pr merge {pr_number} --merge --repo {owner}/{repo}
+   ```
+
+6. **Post to Slack** — release merged notification (see `templates.md`).
+
+7. **Confirm to user** — show merge confirmation and Slack post confirmation.
+
+---
+
+## `/release lock [repo]`
+
+Manually lock the release branch. Use when you need to lock outside of `/release start` (which auto-locks).
+
+### Steps
+
+1. **Detect repo** — match cwd or ask user
+
+2. **Check current lock state:**
+   ```bash
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false'
+   ```
+   If already locked, warn: "Branch `{release_branch}` is already locked. Unlock first?"
+
+3. **Confirm with user** — use AskUserQuestion:
+   "Lock `{release_branch}` on `{repo_name}`? No one will be able to merge until unlocked."
+
+4. **Trigger the lock Action:**
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=lock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+
+5. **Verify lock applied** (wait a few seconds, then check):
+   ```bash
+   sleep 5
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled'
+   ```
+   If still not locked, check the workflow run status:
+   ```bash
+   gh run list --workflow=branch-lock.yml --limit 1 --json status,conclusion --repo {owner}/{repo}
+   ```
+
+6. **Post to Slack** — lock notification (see `templates.md`).
+
+7. **Confirm to user** — "Locked `{release_branch}` on `{repo_name}`."
+
+---
+
+## `/release unlock [repo]`
+
+Unlock the release branch.
+
+### Steps
+
+1. **Detect repo** — match cwd or ask user
+
+2. **Check current lock state:**
+   ```bash
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false'
+   ```
+   If not locked, inform: "Branch `{release_branch}` is not currently locked."
+
+3. **Trigger the unlock Action:**
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=unlock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+
+4. **Verify unlock applied:**
+   ```bash
+   sleep 5
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled'
+   ```
+
+5. **Post to Slack** — unlock notification (see `templates.md`).
+
+6. **Confirm to user** — "Unlocked `{release_branch}` on `{repo_name}`."
 
 ---
 
@@ -90,11 +219,17 @@ Check release status across all configured release repos.
    gh pr list --search "[RELEASE]" --state open --json number,title,url,statusCheckRollup --repo {owner}/{repo}
    ```
 
+   **Lock state:**
+   ```bash
+   gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false'
+   ```
+
 3. **Format and display** as a summary:
 
    ```
    {repo_name}
      Release PR: #{number} — {CI status} (green/pending/failing)
+     Branch lock: {release_branch} — locked/unlocked
    ```
 
    If no open release PR: "No active release"
@@ -104,7 +239,7 @@ Check release status across all configured release repos.
 
 ## `/release complete [repo]`
 
-Close out a release — notify Slack.
+Close out a release — notify Slack and auto-unlock.
 
 ### Steps
 
@@ -124,6 +259,20 @@ Close out a release — notify Slack.
 
 3. **Post to Slack** — release complete notification (see `templates.md`).
 
-4. **Confirm to user:**
+4. **Auto-unlock if locked:**
+   ```bash
+   LOCKED=$(gh api repos/{owner}/{repo}/branches/{release_branch}/protection --jq '.lock_branch.enabled // false')
+   ```
+   If locked, trigger unlock:
+   ```bash
+   gh workflow run branch-lock.yml \
+     -f action=unlock \
+     -f branch={release_branch} \
+     --repo {owner}/{repo}
+   ```
+   Post unlock notification to Slack as well.
+
+5. **Confirm to user:**
    - "Release complete for `{repo_name}`"
+   - "Auto-unlocked `{release_branch}`" (if was locked)
    - Show Slack message confirmation