bigpowers 2.88.12 → 2.88.14

package/.agents/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.cline/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.codebuddy/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.codex/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.copilot/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.cursor/rules/gate-trace.mdc

@@ -69,8 +69,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.gemini/extensions/bigpowers/commands/prompts/gate-trace.md

@@ -69,8 +69,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.12",
+  "version": "2.88.14",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.gemini/extensions/bigpowers/skills/gate-trace/SKILL.md

@@ -71,8 +71,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.hermes/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.kilocode/rules/gate-trace.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.mimocode/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.opencode/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.12",
+  "version": "2.88.14",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/.pi/prompts/gate-trace.md

@@ -69,8 +69,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.pi/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.qwen/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.trae/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.windsurf/rules/gate-trace.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/.zcode/skills/gate-trace/SKILL.md

@@ -70,8 +70,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.88.14](https://github.com/danielvm-git/bigpowers/compare/v2.88.13...v2.88.14) (2026-10-25)
+
+
+### Bug Fixes
+
+* **ci:** gate release on every check in one test-build-release pipeline ([#162](https://github.com/danielvm-git/bigpowers/issues/162)) ([14250d8](https://github.com/danielvm-git/bigpowers/commit/14250d843011da03f766de59f18371276fe16478))
+
+## [2.88.13](https://github.com/danielvm-git/bigpowers/compare/v2.88.12...v2.88.13) (2026-10-25)
+
+
+### Bug Fixes
+
+* **ci:** cut golden suite critical path by removing duplicate gate work ([#161](https://github.com/danielvm-git/bigpowers/issues/161)) ([2db0bb9](https://github.com/danielvm-git/bigpowers/commit/2db0bb98663ae7f44e1990f06e9f90b6db60a773))
+
 ## [2.88.12](https://github.com/danielvm-git/bigpowers/compare/v2.88.11...v2.88.12) (2026-10-25)
 
 

package/CLAUDE.md

@@ -68,7 +68,7 @@ Stack: Markdown / Bash (documentation-based; skills integrate with Claude Code,
 | Lint    | `bash scripts/sync-skills.sh` (validates SKILL.md syntax) |
 | Validate specs YAML | `bash scripts/validate-specs-yaml.sh` |
 | Typecheck | N/A (Markdown / Bash project) |
-| CI platform | GitHub Actions (`.github/workflows/publish.yml`, `sync-skills.yml`, `golden-suite.yml`) |
+| CI platform | GitHub Actions — one pipeline `.github/workflows/test-build-release.yml` (sync, verification-gates, skill-verify, story-verify → release); plus `docs-site.yml`, `publish-wiki.yml` |
 | Compliance | `npm run compliance` |
 | Verification Gates | `bash scripts/run-verification-gates.sh` |
 | Traceability | `bash scripts/trace-stories.sh --strict` | grep for story tags (traceability check) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.12",
+  "version": "2.88.14",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/golden-g13-script-orphans.sh

@@ -53,12 +53,14 @@ is_manual_utility() { # $1 = script path
 }
 
 is_referenced() { # $1 = script basename, $2... = candidate file globs already expanded
+  # One grep over all candidate files per script, not one per (script, file)
+  # pair — the per-file loop forked ~100×N greps and took ~1 min in CI.
   local name="$1"; shift
   local f
-  for f in "$@"; do
-    [[ "$f" == *"/$name" || "$(basename "$f")" == "$name" ]] && continue # self
-    grep -q "$name" "$f" 2>/dev/null && return 0
-  done
+  while IFS= read -r f; do
+    [[ "$f" == *"/$name" || "${f##*/}" == "$name" ]] && continue # self
+    return 0
+  done < <(grep -lF -- "$name" "$@" 2>/dev/null)
   return 1
 }
 
@@ -161,7 +163,7 @@ if [[ -z "$ORPHANS" ]]; then
 fi
 
 echo "  orphaned scripts (present but reachable from no gate, doc, or workflow):"
-printf '%s' "$ORPHANS"
+printf '%s\n' "$ORPHANS"
 echo -e "${RED}FAIL${NC} wire them into a gate, reference them from a skill/doc, tag them '# bp-manual-utility: <reason>', or delete them"
 echo "G-13: FAIL"
 exit 1

package/scripts/lib/golden-suite-gates.sh

@@ -72,8 +72,13 @@ GOLDEN_GATES=(
   "import-boundaries:bash scripts/check-import-boundaries.sh:false"
   "skill-catalog:bash scripts/validate-skill-catalog.sh:false"
   "specs-parse:bash scripts/validate-specs-yaml.sh:false"
+  # The runner itself: failing output is shown, skips are named and reasoned.
+  "golden-gate-runner:bash scripts/test-golden-gate-runner.sh:false"
+  # One pipeline, release needs: every gate, pinned runner and actions.
+  "ci-pipeline-contract-selftest:bash scripts/test-ci-pipeline-contract.sh --self-test:false"
+  "ci-pipeline-contract:bash scripts/test-ci-pipeline-contract.sh:false"
   # Tier 2 of the verify arc (#106): executes the verify: of every story marked
-  # done. Tier 1 (SKILL.md) is run-skill-verify.sh in golden-suite.yml.
+  # done. Tier 1 (SKILL.md) is run-skill-verify.sh in test-build-release.yml.
   "story-verify-selftest:bash scripts/run-story-verify.sh --self-test:false"
   "story-verify:bash scripts/run-story-verify.sh:false"
 )
@@ -120,15 +125,48 @@ golden_agent_dry_run() {
   return 0
 }
 
+# GOLDEN_SKIP_GATES (comma list) skips gates another CI job already runs —
+# test-build-release.yml skips story-verify because its story-verify job runs the
+# same command. Local Preflight leaves it unset, so every gate runs there. A
+# name that matches no gate is a FAIL: a typo must not look like a skip.
+golden_is_skipped() { # $1 = gate name
+  case ",${GOLDEN_SKIP_GATES:-}," in *",$1,"*) return 0 ;; esac
+  return 1
+}
+
+golden_check_skip_names() {
+  local skip gate known
+  for skip in $(printf '%s' "${GOLDEN_SKIP_GATES:-}" | tr ',' ' '); do
+    [[ -z "$skip" ]] && continue
+    known=false
+    for gate in "${GOLDEN_GATES[@]}"; do
+      [[ "${gate%%:*}" == "$skip" ]] && known=true
+    done
+    $known && continue
+    echo -e "[$skip] ${GOLDEN_RED}FAIL${GOLDEN_NC} (GOLDEN_SKIP_GATES names no such gate)"
+    GATE_RESULTS+=("  - name: $skip" "    exit_code: 2" "    duration_seconds: 0" "    status: fail" "    error: unknown gate in GOLDEN_SKIP_GATES")
+    (( FAIL_COUNT += 1 ))
+  done
+}
+
 golden_run_deterministic_gates() {
-  local gate name cmd is_optional main_cmd script_path
+  local gate name cmd is_optional main_cmd script_path gate_out
   PASS_COUNT=0 FAIL_COUNT=0 SKIP_COUNT=0
   GATE_RESULTS=()
+  golden_check_skip_names
 
   for gate in "${GOLDEN_GATES[@]}"; do
     IFS=':' read -r name cmd is_optional <<< "$gate"
     echo -n "[$name] "
 
+    if golden_is_skipped "$name"; then
+      local reason="${GOLDEN_SKIP_REASON:-listed in GOLDEN_SKIP_GATES}"
+      echo -e "${GOLDEN_YELLOW}SKIP${GOLDEN_NC} ($reason)"
+      GATE_RESULTS+=("  - name: $name" "    exit_code: skipped" "    duration_seconds: 0" "    status: skipped" "    note: $reason")
+      (( SKIP_COUNT += 1 ))
+      continue
+    fi
+
     main_cmd=$(echo "$cmd" | awk '{print $1}')
     if [[ "$main_cmd" == "bash" ]]; then
       script_path=$(echo "$cmd" | awk '{print $2}')
@@ -148,7 +186,7 @@ golden_run_deterministic_gates() {
 
     local START_TIME END_TIME DURATION_MS DURATION_SEC GATE_EXIT
     START_TIME=$(date +%s%N)
-    eval "$cmd" >/dev/null 2>&1 && GATE_EXIT=$? || GATE_EXIT=$?
+    gate_out=$(eval "$cmd" 2>&1) && GATE_EXIT=$? || GATE_EXIT=$?
     END_TIME=$(date +%s%N)
     DURATION_MS=$(( (END_TIME - START_TIME) / 1000000 ))
     DURATION_SEC=$(echo "scale=2; $DURATION_MS / 1000" | bc 2>/dev/null || echo "0")
@@ -159,6 +197,8 @@ golden_run_deterministic_gates() {
       (( PASS_COUNT += 1 ))
     else
       echo -e "${GOLDEN_RED}FAIL${GOLDEN_NC} (${DURATION_SEC}s, exit $GATE_EXIT)"
+      # Without the tail, CI shows FAIL with no reason (#158: compliance).
+      printf '%s\n' "$gate_out" | tail -20 | sed 's/^/    | /'
       GATE_RESULTS+=("  - name: $name" "    exit_code: $GATE_EXIT" "    duration_seconds: $DURATION_SEC" "    status: fail")
       (( FAIL_COUNT += 1 ))
     fi

package/scripts/run-story-verify.sh

@@ -41,7 +41,7 @@ PASS=0; FAIL=0; SKIP=0
 TARGET="${1:-}"
 
 extract_records() {
-  "$PYTHON" "$REPO_ROOT/scripts/lib/extract-story-verify.py" "$REPO_ROOT"
+  "$PYTHON" "$REPO_ROOT/scripts/lib/extract-story-verify.py" "${EXTRACT_ROOT:-$REPO_ROOT}"
 }
 
 # Report a story whose directive can never fail. Kept separate from execution so
@@ -58,6 +58,55 @@ reject_non_executable() {
   FAIL=$((FAIL + 1))
 }
 
+# Many stories share one verify (e61s02…e76s02 all run the same installer
+# test); same command at the same commit gives the same result, so run it once
+# per gate_all and reuse the verdict for every story that declares it.
+# Sets RUN_RC, RUN_OUT, and RUN_REUSED (1 when nothing new ran).
+run_memoized() {
+  local cmd="$1" key
+  key=$(printf '%s' "$cmd" | cksum | tr -d ' ')
+  if [ -n "${MEMO_DIR:-}" ] && [ -f "$MEMO_DIR/$key.rc" ]; then
+    RUN_RC=$(cat "$MEMO_DIR/$key.rc")
+    RUN_OUT=$(cat "$MEMO_DIR/$key.out")
+    return 0
+  fi
+  RUN_REUSED=0
+  RUN_OUT=$(run_with_timeout "$cmd") && RUN_RC=0 || RUN_RC=$?
+  if [ -n "${MEMO_DIR:-}" ]; then
+    printf '%s' "$RUN_RC" > "$MEMO_DIR/$key.rc"
+    printf '%s' "$RUN_OUT" > "$MEMO_DIR/$key.out"
+  fi
+}
+
+# A plain `a && b && c` chain shares no shell state between segments when it
+# has no quoting, expansion, grouping, pipes, `;`, cd, export or assignment —
+# so each segment can be cached on its own (test-adapter-render.sh prefixes ten
+# different story verifies). Anything else is cached as one whole command.
+is_plain_and_chain() {
+  case "$1" in
+    *\'*|*\"*|*\$*|*\`*|*\(*|*\)*|*\{*|*\}*|*\|*|*\;*|*=*|*\<*) return 1 ;;
+  esac
+  printf '%s' "$1" | grep -qE '(^|&&)[[:space:]]*(cd|export|source|\.)[[:space:]]' && return 1
+  return 0
+}
+
+run_verify_cmd() {
+  local cmd="$1" seg
+  RUN_REUSED=1
+  if ! is_plain_and_chain "$cmd"; then
+    run_memoized "$cmd"
+    return
+  fi
+  local rest="$cmd"
+  while :; do
+    seg=${rest%%&&*}
+    run_memoized "$(printf '%s' "$seg" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+    [ "$RUN_RC" -eq 0 ] || return
+    [ "$seg" = "$rest" ] && return
+    rest=${rest#*&&}
+  done
+}
+
 run_story_verify() {
   local sid="$1" src="$2" cmd="$3"
 
@@ -70,20 +119,23 @@ run_story_verify() {
     return 1
   fi
 
-  local output
-  if output=$(run_with_timeout "$cmd"); then
-    echo "PASS: $sid"
+  run_verify_cmd "$cmd"
+  local note=""
+  [ "$RUN_REUSED" -eq 1 ] && note=" (shared result)"
+  if [ "$RUN_RC" -eq 0 ]; then
+    echo "PASS: $sid$note"
     PASS=$((PASS + 1))
     return 0
   fi
-  echo "FAIL: $sid [$src] — $cmd"
-  echo "      output: $(echo "$output" | tail -3 | tr '\n' ' ')"
+  echo "FAIL: $sid [$src]$note — $cmd"
+  echo "      output: $(echo "$RUN_OUT" | tail -3 | tr '\n' ' ')"
   FAIL=$((FAIL + 1))
   return 1
 }
 
 gate_all() {
   local sid src status cmd
+  MEMO_DIR=$(mktemp -d)
   while IFS=$'\t' read -r sid src status cmd; do
     [ -z "${sid:-}" ] && continue
     if [ -n "$TARGET" ] && [ "$sid" != "$TARGET" ]; then
@@ -96,6 +148,58 @@ gate_all() {
     fi
     run_story_verify "$sid" "$src" "$cmd" || true
   done < <(extract_records)
+  rm -rf "$MEMO_DIR"
+  MEMO_DIR=""
+}
+
+# Shared-command proof: stories that declare the same verify run it once, yet
+# each story still gets its own verdict — a failing shared command fails every
+# story that declares it, never just the first.
+self_test_shared_commands() {
+  local root="$1/shared" out runs
+  mkdir -p "$root/specs/epics/e98-shared"
+  cat > "$root/specs/epics/e98-shared/epic.yaml" <<YAML
+id: e98
+title: shared-command capsule
+stories:
+  - id: e98s01
+    status: done
+    verify: printf x >> $root/ok-runs && test -d $root/specs
+  - id: e98s02
+    status: done
+    verify: printf x >> $root/ok-runs && test -d $root/specs
+  - id: e98s03
+    status: done
+    verify: printf x >> $root/bad-runs && test -f $root/missing
+  - id: e98s04
+    status: done
+    verify: printf x >> $root/bad-runs && test -f $root/missing
+  - id: e98s05
+    status: done
+    verify: printf x >> $root/seg-runs && test -d $root/specs
+  - id: e98s06
+    status: done
+    verify: printf x >> $root/seg-runs && test -d $root/specs/epics
+  - id: e98s07
+    status: done
+    verify: printf x >> $root/seg-runs && test -f $root/missing
+YAML
+  out=$(EXTRACT_ROOT="$root" TARGET="" PASS=0 FAIL=0 SKIP=0 gate_all)
+  local problems=0
+  runs=$(wc -c < "$root/ok-runs" | tr -d ' ')
+  [ "$runs" = "1" ] || { echo "FAIL: self-test — shared passing command ran $runs times, want 1"; problems=$((problems + 1)); }
+  runs=$(wc -c < "$root/bad-runs" | tr -d ' ')
+  [ "$runs" = "1" ] || { echo "FAIL: self-test — shared failing command ran $runs times, want 1"; problems=$((problems + 1)); }
+  runs=$(wc -c < "$root/seg-runs" | tr -d ' ')
+  [ "$runs" = "1" ] || { echo "FAIL: self-test — shared && segment ran $runs times, want 1"; problems=$((problems + 1)); }
+  local sid
+  for sid in e98s01 e98s02 e98s05 e98s06; do
+    echo "$out" | grep -q "^PASS: $sid" || { echo "FAIL: self-test — $sid not reported PASS"; problems=$((problems + 1)); }
+  done
+  for sid in e98s03 e98s04 e98s07; do
+    echo "$out" | grep -q "^FAIL: $sid" || { echo "FAIL: self-test — $sid not reported FAIL"; problems=$((problems + 1)); }
+  done
+  [ "$problems" -eq 0 ]
 }
 
 # Anti-vacuity proof: seed a capsule whose done story must fail, and one that
@@ -178,6 +282,8 @@ EOF
   rm -rf "$tmp_root"
   trap - EXIT
 
+  self_test_shared_commands "$tmp_root" || problems=$((problems + 1))
+
   if [ "$checked" -lt 5 ]; then
     echo "FAIL: self-test — extractor found $checked/5 fixture stories"
     return 1

package/scripts/test-ci-pipeline-contract.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# story: BUG-2026-10-25-release-not-gated
+# test-ci-pipeline-contract.sh — the CI shape the portfolio template requires
+# (danielvm-git/.github, docs/concept/github-actions-best-practices.md):
+#
+#   1. one pipeline, .github/workflows/test-build-release.yml, holds every gate
+#      job and the release job; the workflows it replaced are gone
+#   2. release needs: every gate job and runs only on push to main — a release
+#      that does not wait for the gates publishes unverified builds
+#   3. no ubuntu-latest; every non-local action is pinned to a 40-char SHA
+#   4. every job has timeout-minutes
+#   5. release and Pages never cancel a run in progress
+#
+# Agent workflows (agent-locks.yml, generated agentics-maintenance.yml) are
+# exempt from 3–4 per migration plan v2.
+#
+# Usage: bash scripts/test-ci-pipeline-contract.sh [--self-test] [workflows-dir]
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+source scripts/lib/python-env.sh
+resolve_python >/dev/null || exit 1
+
+check_dir() { # $1 = workflows dir; prints violations, exits non-zero on any
+  "$PYTHON" - "$1" <<'PY'
+import glob, os, re, sys, yaml
+
+d = sys.argv[1]
+GATES = {"sync", "verification-gates", "skill-verify", "story-verify"}
+RETIRED = ["publish.yml", "sync-skills.yml", "golden-suite.yml"]
+EXEMPT = {"agent-locks.yml", "agentics-maintenance.yml"}
+bad = []
+
+def load(path):
+    with open(path) as f:
+        return yaml.safe_load(f) or {}
+
+def cancels(block):
+    # Literal true cancels; an expression or false does not cancel a push run.
+    return isinstance(block, dict) and block.get("cancel-in-progress") is True
+
+pipe_path = os.path.join(d, "test-build-release.yml")
+if not os.path.isfile(pipe_path):
+    bad.append("test-build-release.yml missing")
+else:
+    pipe = load(pipe_path)
+    jobs = pipe.get("jobs", {})
+    missing = GATES - set(jobs)
+    if missing:
+        bad.append(f"pipeline lacks gate jobs: {sorted(missing)}")
+    rel = jobs.get("release")
+    if not rel:
+        bad.append("pipeline has no release job")
+    else:
+        needs = rel.get("needs", [])
+        needs = {needs} if isinstance(needs, str) else set(needs)
+        gate_jobs = set(jobs) - {"release"}
+        if not gate_jobs <= needs:
+            bad.append(f"release does not need: {sorted(gate_jobs - needs)}")
+        cond = str(rel.get("if", ""))
+        if "github.event_name == 'push'" not in cond or "refs/heads/main" not in cond:
+            bad.append("release is not limited to push on main")
+        if cancels(pipe.get("concurrency")) or cancels(rel.get("concurrency")):
+            bad.append("release can be cancelled in progress")
+
+for name in RETIRED:
+    if os.path.exists(os.path.join(d, name)):
+        bad.append(f"retired workflow still present: {name}")
+
+docs = os.path.join(d, "docs-site.yml")
+if os.path.isfile(docs) and cancels(load(docs).get("concurrency")):
+    bad.append("docs-site.yml: Pages deploy can be cancelled in progress")
+
+for path in sorted(glob.glob(os.path.join(d, "*.yml"))):
+    name = os.path.basename(path)
+    if name in EXEMPT:
+        continue
+    for job_name, job in (load(path).get("jobs") or {}).items():
+        where = f"{name}:{job_name}"
+        if "uses" in job:  # reusable-workflow call: no runner of its own
+            continue
+        if "ubuntu-latest" in str(job.get("runs-on", "")):
+            bad.append(f"{where}: runs-on ubuntu-latest")
+        if "timeout-minutes" not in job:
+            bad.append(f"{where}: no timeout-minutes")
+        for step in job.get("steps", []):
+            uses = step.get("uses")
+            if uses and not uses.startswith("./") and not re.search(r"@[0-9a-f]{40}$", uses):
+                bad.append(f"{where}: action not SHA-pinned: {uses}")
+
+for b in bad:
+    print(f"FAIL: {b}")
+sys.exit(1 if bad else 0)
+PY
+}
+
+# Anti-vacuity: a conforming fixture passes, and each rule fails on its own breach.
+self_test() {
+  local tmp ok=1
+  tmp=$(mktemp -d)
+  trap "rm -rf '$tmp'" EXIT
+  local pin="actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"
+  write_fixture() { # $1 = dir
+    mkdir -p "$1"
+    cat > "$1/test-build-release.yml" <<YAML
+on: push
+jobs:
+  sync: {runs-on: ubuntu-22.04, timeout-minutes: 10, steps: [{uses: $pin}]}
+  verification-gates: {runs-on: ubuntu-22.04, timeout-minutes: 15, steps: [{run: "true"}]}
+  skill-verify: {runs-on: ubuntu-22.04, timeout-minutes: 10, steps: [{run: "true"}]}
+  story-verify: {runs-on: ubuntu-22.04, timeout-minutes: 10, steps: [{run: "true"}]}
+  release:
+    needs: [sync, verification-gates, skill-verify, story-verify]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    concurrency: {group: release, cancel-in-progress: false}
+    steps: [{run: "true"}]
+YAML
+  }
+  expect() { # $1 = label, $2 = want pass|fail, $3 = dir
+    if check_dir "$3" >/dev/null; then got=pass; else got=fail; fi
+    if [ "$got" = "$2" ]; then echo "PASS ($1)"; else echo "FAIL ($1): got $got, want $2"; ok=0; fi
+  }
+
+  write_fixture "$tmp/good"; expect "conforming pipeline passes" pass "$tmp/good"
+
+  write_fixture "$tmp/no-needs"
+  sed -i.bak 's/needs: \[sync, verification-gates, skill-verify, story-verify\]/needs: [sync]/' "$tmp/no-needs/test-build-release.yml"
+  expect "release missing gate needs fails" fail "$tmp/no-needs"
+
+  write_fixture "$tmp/latest"
+  sed -i.bak 's/runs-on: ubuntu-22.04, timeout-minutes: 15/runs-on: ubuntu-latest, timeout-minutes: 15/' "$tmp/latest/test-build-release.yml"
+  expect "ubuntu-latest fails" fail "$tmp/latest"
+
+  write_fixture "$tmp/tag"
+  sed -i.bak "s|$pin|actions/checkout@v7|" "$tmp/tag/test-build-release.yml"
+  expect "tag-pinned action fails" fail "$tmp/tag"
+
+  write_fixture "$tmp/cancel"
+  sed -i.bak 's/cancel-in-progress: false/cancel-in-progress: true/' "$tmp/cancel/test-build-release.yml"
+  expect "cancellable release fails" fail "$tmp/cancel"
+
+  write_fixture "$tmp/retired"; : > "$tmp/retired/publish.yml"
+  expect "retired workflow present fails" fail "$tmp/retired"
+
+  [ "$ok" -eq 1 ] && echo "OK: pipeline contract self-test" || { echo "pipeline contract self-test FAILED"; exit 1; }
+}
+
+if [ "${1:-}" = "--self-test" ]; then
+  self_test
+  exit 0
+fi
+
+dir="${1:-.github/workflows}"
+if check_dir "$dir"; then
+  echo "OK: CI pipeline contract ($dir)"
+else
+  echo "CI pipeline contract violated — see danielvm-git/.github docs/concept/github-actions-best-practices.md"
+  exit 1
+fi

package/scripts/test-golden-gate-runner.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# story: BUG-2026-10-25-ci-critical-path
+# test-golden-gate-runner.sh — regression guard for golden_run_deterministic_gates.
+#
+# Runs the real runner against a fixture gate list and asserts:
+#   (a) a failing gate prints the tail of its output (CI used to show only FAIL)
+#   (b) GOLDEN_SKIP_GATES reports a named gate as SKIP with its reason
+#   (c) an unknown name in GOLDEN_SKIP_GATES is a FAIL, so a typo cannot
+#       silently disable nothing while claiming to skip something
+#   (d) without GOLDEN_SKIP_GATES every gate runs — the default stays full
+#
+# Usage: bash scripts/test-golden-gate-runner.sh
+
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+FAILURES=0
+pass() { echo "PASS $1"; }
+fail() { echo "FAIL $1"; FAILURES=$((FAILURES + 1)); }
+
+# Run the runner in a subshell with a fixture gate list; prints its stdout and
+# the final counters as "COUNTS pass fail skip".
+run_fixture() {
+  (
+    source scripts/lib/golden-suite-gates.sh
+    GOLDEN_GATES=(
+      "ok-gate:true:false"
+      "bad-gate:sh -c 'echo marker-line-from-failing-gate; exit 3':false"
+      "covered-gate:true:false"
+    )
+    golden_run_deterministic_gates
+    echo "COUNTS $PASS_COUNT $FAIL_COUNT $SKIP_COUNT"
+  )
+}
+
+out=$(GOLDEN_SKIP_GATES="" run_fixture)
+echo "$out" | grep -q 'marker-line-from-failing-gate' \
+  && pass "(a) failing gate output is printed" \
+  || fail "(a) failing gate output is missing"
+echo "$out" | grep -q '^COUNTS 2 1 0$' \
+  && pass "(d) no skip list runs every gate" \
+  || fail "(d) default run counts wrong: $(echo "$out" | grep COUNTS)"
+
+out=$(GOLDEN_SKIP_GATES="covered-gate" GOLDEN_SKIP_REASON="runs in its own CI job" run_fixture)
+echo "$out" | grep -q '^\[covered-gate\] .*SKIP.*runs in its own CI job' \
+  && pass "(b) skipped gate reported with reason" \
+  || fail "(b) skipped gate not reported with reason"
+echo "$out" | grep -q '^COUNTS 1 1 1$' \
+  && pass "(b) skipped gate counted as skip, not pass" \
+  || fail "(b) skip counts wrong: $(echo "$out" | grep COUNTS)"
+
+out=$(GOLDEN_SKIP_GATES="no-such-gate" run_fixture)
+echo "$out" | grep -q 'no-such-gate' && echo "$out" | grep -q '^COUNTS 2 2 0$' \
+  && pass "(c) unknown skip name fails the run" \
+  || fail "(c) unknown skip name accepted: $(echo "$out" | grep COUNTS)"
+
+[ "$FAILURES" -eq 0 ] && echo "OK: golden gate runner" || { echo "$FAILURES check(s) failed"; exit 1; }

package/skills/gate-trace/SKILL.md

@@ -75,8 +75,8 @@ gate_trace:
 ## Integration Points
 
 - **release-branch SKILL.md** — pre-PR gate (FAIL blocks merge).
-- **sync-skills.yml** — runs `trace-stories.sh --strict` as its "Traceability gate" step (FAIL
-  blocks pipeline), which shares this skill's coverage data (`traceability-matrix.json`) but
+- **test-build-release.yml** — its `sync` job runs `trace-stories.sh --strict` as the "Traceability gate" step (FAIL
+  blocks the release job), which shares this skill's coverage data (`traceability-matrix.json`) but
   does not invoke a gate-trace PASS/CONCERNS/FAIL/WAIVED verdict directly.
 - **verify-work SKILL.md** — runs blind-spot checks; gate-trace consumes the result.
 

package/skills-lock.json

@@ -143,7 +143,7 @@
     },
     "gate-trace": {
       "description": "\"Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability.\"",
-      "sha256": "978894220e82c96a",
+      "sha256": "282c950cf9db124a",
       "path": "skills/gate-trace/SKILL.md"
     },
     "generate-allure-report": {