@rallycry/conveyor-agent 11.0.39 → 11.0.41

package/skills/conveyor-release-review/references/report-and-cards.md

@@ -0,0 +1,183 @@
+# Report and card templates
+
+The shapes behind steps 6 and 7 of
+[conveyor-release-review](../SKILL.md). Fill them in; do not pad them. A
+section with nothing to say is written as one line saying so, never dropped,
+because a missing section reads as a skipped check.
+
+`<label>` is `Release <version>` when a release is cut, and
+`Pre-release <YYYY-MM-DD>` otherwise.
+
+## The report
+
+Posted to the conversation, and to the release card's chat when one exists.
+
+```markdown
+**HOLD — <label> @ <tip sha, 7 chars>.** 2 High findings. Blockers: <pack link>
+
+Reviewed `origin/<default>...<tip>`: 38 PRs, 214 files. Tip recorded
+<timestamp>; <"unchanged at report time" | "moved to <sha>, N commits not reviewed">.
+
+### Findings
+
+| Priority | Finding | Evidence | Introduced by | Card |
+| --- | --- | --- | --- | --- |
+| High | Unique index fails on 14 duplicate rows | Observed | #4712 | <link> |
+| Medium | Board filter matches nothing after status rename | Proven | #4698 + #4705 | <link> |
+
+Release blockers: <pack link> (2 cards, Open)
+Release suggestions: <pack link> (3 cards, Planning)
+
+### Deploy checklist
+
+- [ ] Set `<VARIABLE>` in production before the API deploys (#4720)
+- [ ] Nothing else requires a human step.
+
+### Coverage
+
+38 of 38 PRs evaluated. 2 without a card, reviewed on the diff alone: #4701, #4733.
+
+| Dimension | Result |
+| --- | --- |
+| Cross-PR interaction | 1 finding. 6 overlapping surfaces read as combined diffs. |
+| Data and migrations | 1 finding. 4 migrations, none lock-heavy at production size. |
+| Rollback and off-switches | Clean. |
+| ... | ... |
+
+### Struck
+
+| Candidate | Struck because |
+| --- | --- |
+| Add a retry to the export job | Redundant: the queue already retries 3 times (`jobs/queue.ts:88`) |
+| Guard against a malformed legacy payload | Niche and graceful: 0 occurrences in 30 days, error already surfaces to the user |
+
+### Unverified
+
+| Candidate | Would be | What would settle it |
+| --- | --- | --- |
+| Webhook handler may double-fire on redelivery | High | A redelivery against the dev environment, or the provider's delivery log |
+
+### Method
+
+Evidence sources used: dev and prod logs, local stack, read-only production data.
+Unavailable: <source>, so <which dimensions rest on static reading>.
+Not reviewed: <anything skipped, and why>.
+```
+
+Rules for the verdict line:
+
+- It is the **first line**, in both destinations. Someone who reads nothing
+  else must still get the verdict.
+- It names the SHA. A verdict without one cannot be checked against what
+  actually shipped.
+- `SHIP WITH OPEN QUESTIONS` names each open question on that same line or the
+  next one. It is not a softer `SHIP`.
+
+## The hold notice
+
+Posted to the release card when the verdict is `HOLD`. The first line carries
+the whole message; the report follows beneath it.
+
+```markdown
+**HOLD — do not ship <label> until the blockers merge.** 2 High findings: <pack link>
+```
+
+## The pack parent
+
+```markdown
+## Objective
+Clear the findings that block <label>, found by the release review of
+`<tip sha>` on <date>.
+
+## Approach
+Each child is one finding with its own evidence and its own smallest fix.
+They are independent unless a `dependsOn` edge says otherwise.
+
+## Implementation Steps
+1. <child title> — <one line>
+2. <child title> — <one line>
+
+## Testing
+Each child carries its own gates and acceptance criteria.
+
+## Notes
+- Release card: <link>. Reviewed SHA: `<tip sha>`.
+- <One of:> This is a full release, so fixes merged to `<dev>` ship with it.
+  <or> This is a cherry-pick release: once these merge, a human adds them with
+  Add to Release.
+- Priority is the urgency of the fix. Risk is set by identification and review.
+
+## Builder briefing
+- **Start here:** the child with the earliest deploy-time consequence.
+- **Already decided:** each fix is the smallest change that removes the
+  consequence. Do not widen it.
+- **Traps:** <what looks right and is not>
+- **Verify in this order:** re-run each child's evidence command first; a
+  finding that no longer reproduces is a finding someone already fixed.
+```
+
+The suggestions pack uses the same shape. Its Objective says these are worth
+doing and do not hold the release, and its Notes say the pack sits in Planning
+until a human promotes it.
+
+## The finding card
+
+One per finding, as a pack child or as a standalone card. It follows the
+`/conveyor-plan` plan format
+([plan-format.md](../../conveyor-plan/references/plan-format.md)) with two
+sections added at the top, because a builder who cannot re-run the evidence
+cannot tell a fixed finding from a wrong one.
+
+```markdown
+## Finding
+<What breaks, for whom, and when. One short paragraph.>
+
+Priority: <level>. Found in <label> @ `<tip sha>`. Release card: <link>.
+Introduced by: #<pr> (<card slug>), #<pr> (<card slug>).
+
+## Evidence
+Grade: <Observed | Reproduced | Proven>
+
+    <the exact query or command>
+
+Result: <what it returned, with the numbers>
+
+## Objective
+<One sentence: the consequence this card removes.>
+
+## Approach
+<The smallest change that removes it, and why nothing larger is needed.>
+
+## Implementation Steps
+1. `path/to/file.ts:120` — `symbolName`: <the change>
+2. ...
+
+## Testing
+- Gates: <the repo's scoped commands for this diff>
+- The evidence command above no longer shows the failure.
+- Manual tests (0-3): <plain sentences, user path only>
+
+## Notes
+- What the adversarial pass considered and rejected: <larger fixes, and why>
+- Blast radius: <callers and consumers of what this touches>
+
+## Builder briefing
+- **Start here:** <file>
+- **Already decided:** <what not to reopen, and why>
+- **Traps:** <what looks right and is not>
+- **Verify in this order:** <cheapest disqualifying check first>
+```
+
+Rules for the card:
+
+- **The description is for a non-engineer**: one or two plain sentences on
+  what goes wrong and for whom. Technical detail goes in the plan.
+- **The title names the consequence, not the dimension.** "Deploy fails on
+  duplicate slugs", not "Migration issue".
+- **Evidence is reproducible or it is not evidence.** An exact command, not
+  "checked the logs".
+- **Never paste a secret, a token or personal data** into a card. Quote the
+  shape of the log line, not the user's email in it.
+- **The fix is the smallest one.** Anything larger that the adversarial pass
+  rejected is recorded under Notes, so the builder does not rediscover it and
+  build it anyway.

package/skills/conveyor-workflows/SKILL.md

@@ -132,6 +132,7 @@ labels. Each tag carries a `description` (≤255 — the summary), an `overview`
   | Hand it to the cloud | `conveyor-start` → starts a pod and confirms it came up (local surface only — `start_task` does not exist in a pod) |
   | Do the work here | `conveyor-build` → follows the plan to a PR |
   | Judge the work | `conveyor-review` → one verdict, with risk |
+  | Audit a release before it ships | `conveyor-release-review` → evidence-backed findings, filed by priority as a blocker pack and a suggestions pack (local surface only — it needs `create_task`, `manage_priorities`, and `add_dependency` on another card) |
   | Work a whole queue locally | `conveyor-local-loop` → selection and pacing over the above |
   | Keep the board honest | `conveyor-prune` → one disposition per open card, applied only after confirmation (local surface only — it needs `set_task_parent`, `create_task`, and the on-hold flag) |