@sjawhar/pi-legion-envoy 1.17.3 → 1.18.0

package/dist/skills/legion-architect/SKILL.md

@@ -34,6 +34,13 @@ separate coordinator to finish necessary work.
   create and continue to own. Re-file a genuinely independent child through the
   controller rather than treating it as an abandoned dependency.
 
+## Deployment instructions
+
+Deployment instructions, when present, are the operator's standing rules for this repository —
+required checks, deploy/smoke commands, code-owner expectations, standing roles you may consult,
+the merge credential. They override this skill's defaults where they conflict; they never
+override a Sami ruling quoted here.
+
 ## 1. Decompose or adopt
 
 Inspect the root issue, acceptance criteria, existing children, and current handoffs.

package/dist/skills/legion-controller/SKILL.md

@@ -33,6 +33,13 @@ listener restart.
 This handshake lets the daemon redeliver held controller work. It does not turn the controller
 into a state holder: daemon state and the Dispatch project remain authoritative.
 
+## Deployment instructions
+
+Deployment instructions, when present, are the operator's standing rules for this repository —
+required checks, deploy/smoke commands, code-owner expectations, standing roles you may consult,
+the merge credential. They override this skill's defaults where they conflict; they never
+override a Sami ruling quoted here.
+
 ## Turn discipline
 
 - **Direct user message always first.** If this turn includes a direct user message, answer

package/dist/skills/legion-oracle/SKILL.md

@@ -36,11 +36,12 @@ digraph oracle_decision {
 
 ## Research Strategy
 
-If the deployment instructions name a librarian role, ask it first (publish to its
-`notifications.role.<name>` topic with `expects_reply: required`). Then run steps 1-2 (parallel
-OK), and 3-4 if needed, with tools a Legion pane actually has: `read`, `grep`, `web_search`, and
-`task(agent="scout")` (fast read-only codebase search) or `task(agent="oracle")` (deeper
-read-only analysis when the answer needs judgment across many files). Do not name any other agent.
+If the deployment instructions name a librarian (or oracle) role, publish your question to
+`notifications.role.<name>` with `expects_reply: required` and wait for the reply before
+researching yourself. Then run steps 1-2 (parallel OK), and 3-4 if needed, with tools a Legion
+pane actually has: `read`, `grep`, `web_search`, and `task(agent="scout")` (fast read-only
+codebase search) or `task(agent="oracle")` (deeper read-only analysis when the answer needs
+judgment across many files). Do not name any other agent.
 
 | Step | Tool | Query |
 |------|------|-------|

package/dist/skills/legion-retro/SKILL.md

@@ -21,6 +21,10 @@ retrospective's durable output.
    Retro writes **no `.legion` file**, so it never re-dirties the cleaned handoff tree.
 4. The merger verifies the approved head, publishes `READY`, and pushes nothing; the merge queue
    merges under the repository's own rules.
+5. After the merge lands, the implementer — not the reviewer, the merger, or the queue — verifies
+   the change in production and records it on the PR and the issue (Sami, 2026-09-13, verbatim:
+   "the agent that developed it should be responsible for testing in production"). The
+   architect's sign-off waits for that record.
 
 Do not start retro before step 2, skip it because the change seems mechanical, or publish `READY`
 before step 3. The design gate is not a substitute for review and retro.
@@ -28,6 +32,10 @@ before step 3. The design gate is not a substitute for review and retro.
 ## Two perspectives
 
 1. Re-read the issue, its acceptance criteria, the PR, test evidence, and review evidence.
+   Confirm the PR's `E2E` line links a pre-merge proof on a production-like surface (a devN
+   stack, staging, or a local stack with real migrations). If it links only a unit suite or
+   nothing, the retro's first durable learning is that gap, and the issue goes back to the
+   tester before `READY`.
    Do not rebase or create a new branch; work on the existing issue branch.
 2. Spawn one fresh-eyes subagent. Give it the issue and PR, ask it to inspect the diff and
    return concrete reusable learnings, and require it to return analysis rather than edit files.

package/dist/skills/legion-worker/SKILL.md

@@ -55,6 +55,13 @@ round, a question) can deliver a new prompt to this same session. Treat it as a
 continuation — re-read the current issue and your own prior handoff, since time has
 passed — never as a fresh identity.
 
+## Deployment instructions
+
+Deployment instructions, when present, are the operator's standing rules for this repository —
+required checks, deploy/smoke commands, code-owner expectations, standing roles you may consult,
+the merge credential. They override this skill's defaults where they conflict; they never
+override a Sami ruling quoted here.
+
 ## Asking another role
 
 Reach any live role on this issue the same way you reach the architect: `envoy_publish` to
@@ -242,7 +249,23 @@ Negative control: <deliberately broken input> → <refusal or failure observed>.
 - The tester fills in the `E2E` section: the real surface a user reaches the criterion
   through, the exact command or run id, what was observed, the head SHA, and one negative
   control — a deliberately broken input and the refusal or failure it produced. A unit or
-  integration test is a regression lock, never proof of a criterion. Environment or
+  integration test is a regression lock, never proof of a criterion. The surface is
+  **production-like** — a devN stack, staging, or a local stack with real migrations, one that
+  has the resource the change touches — and the `E2E` line carries a **link** to that run,
+  screenshot, or e2e; the merge queue does not approve a user-facing change without it, and a
+  green unit suite is not it. Sami, 2026-09-13, verbatim: "They need to test everything in a
+  production-like environment before merging, and it is the agent that develops the feature
+  that is responsible for doing that. If there's anything blocking that, we need to fix it: if
+  it's infrastructure, we need to fix it; if it's tooling, we need to develop it; if it's
+  skills, we need to fix the skills ... it should not require deploying to production to
+  realize your feature doesn't work." A code path whose first execution is after merge — a
+  deploy workflow's inline step, a post-merge helper, a production-only resource — is untested
+  until the implementer has executed it against a devN stack; if no surface can reach it, the
+  tester names that missing surface as the blocker instead of passing the phase. Evidence for
+  the rule: in the week of 2026-09-08 three surfaces merged green and were wrong on inspection
+  (the Astrolabe IPI stack, Dispatch on ECS, the candidate flow), and on 2026-09-12 six deploy
+  slots died on code first executed after merge, including a production-only ECS bootstrap the
+  whole staging gate never ran. Environment or
   secret-scrub evidence (e.g. "`LEGION_*`/`DISPATCH_*`/`ENVOY_*` unset") is recorded once, in
   `.legion/test.json`, and only when the issue's acceptance criteria call for it — never
   re-pasted into the PR body each round.
@@ -266,6 +289,15 @@ Negative control: <deliberately broken input> → <refusal or failure observed>.
   `READY #<n> at <sha>` plus the PR body's gate facts to the merge queue's role
   (`notifications.role.pr-queue`) with `envoy_publish`. The merger never merges; the queue
   merges under its own authority.
+- **After the queue merges, the implementer verifies in production.** Sami, 2026-09-13,
+  verbatim: "the agent that developed it should be responsible for testing in production."
+  The architect sends the implementer back once the merge lands; the implementer watches the
+  deploy slot that carries the merge to `production-apply` (or the equivalent publish step),
+  drives the changed path in production through the user's own access path, and records the
+  observation on the PR and the issue before the architect signs off. A staging pass is not
+  this: on 2026-09-12 a slot's entire staging gate passed at 00:02Z and its production-apply
+  failed at 00:12Z on a resource staging never runs. If the slot fails on the change, the
+  implementer owns the fix and the next slot.
 
 ## Completion gate: handoff write, verification, and persistence
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "1.17.3",
+  "version": "1.18.0",
   "type": "module",
   "omp": {
     "extensions": [