start-vibing-stacks 2.40.0 → 2.41.0

package/README.md

@@ -6,7 +6,7 @@ Multi-stack AI workflow for **Claude Code** & **Cursor**. One command installs a
 npx start-vibing-stacks
 ```
 
-> Latest: **v2.40.0** — New `email-push-marketing` skill + always-on memory: owned-list email/push in sensitive niches + **2026 inbox deliverability** (SPF/DKIM/DMARC/BIMI, bulk rules) without niche-content bans. Hard limits: no phishing / bank-brand impersonation. Universal skills: **32**.
+> Latest: **v2.41.0** — Post-push **GitHub Actions** verification: `commit-manager` v3.2.0 Step 5.5 + always-on memory `post-push-ci-verification` + `git-workflow` §5.5. After push, `gh run list/watch` before claiming CI/deploy success.
 
 ---
 
@@ -213,12 +213,13 @@ This release includes a comprehensive set of permissive memories for legitimate
 6. SECURITY       security-auditor — VETO on CRITICAL/HIGH/MEDIUM findings
 7. QUALITY        quality-gate: typecheck → lint → test → build
 8. COMMIT         commit-manager — verifies gates, diff-driven message, push
-9. DOCUMENT       documenter — maps files/commits to domains, regenerates _index.json
-10. WISDOM        domain-updater — records session learnings, PREPENDS new entry to CLAUDE.md ## Recent Changes (append-only LIFO, cap 10, multi-instance safe)
-11. COMPACT       claude-md-compactor — triggers if CLAUDE.md > 20 KB
+9. CI VERIFY      gh run list/watch for pushed SHA — report deploy/release if present
+10. DOCUMENT      documenter — maps files/commits to domains, regenerates _index.json
+11. WISDOM        domain-updater — records session learnings, PREPENDS new entry to CLAUDE.md ## Recent Changes (append-only LIFO, cap 10, multi-instance safe)
+12. COMPACT       claude-md-compactor — triggers if CLAUDE.md > 20 KB
 ```
 
-Steps 6–7 cannot be skipped — `security-auditor` and `quality-gate` veto `commit-manager` on findings.
+Steps 6–7 cannot be skipped — `security-auditor` and `quality-gate` veto `commit-manager` on findings. Step 9 is required after push on GitHub remotes (memory `post-push-ci-verification`).
 
 ---
 

package/dist/migrate.js

@@ -405,6 +405,7 @@ export function patchSettings(projectDir, dryRun) {
         '.claude/memories/paid-ads-landing-validation.md',
         '.claude/memories/owned-infra-ops.md',
         '.claude/memories/email-push-marketing-authorization.md',
+        '.claude/memories/post-push-ci-verification.md',
     ];
     if (!settings.context)
         settings.context = {};

package/dist/setup.js

@@ -266,6 +266,7 @@ export async function setupProject(projectDir, config, options = {}) {
                     '.claude/memories/paid-ads-landing-validation.md',
                     '.claude/memories/owned-infra-ops.md',
                     '.claude/memories/email-push-marketing-authorization.md',
+                    '.claude/memories/post-push-ci-verification.md',
                 ],
             },
             permissions: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "start-vibing-stacks",
-  "version": "2.40.0",
+  "version": "2.41.0",
   "description": "AI-powered multi-stack dev workflow for Claude Code. Supports PHP, Node.js, Python and more.",
   "type": "module",
   "bin": {

package/stacks/_shared/agents/commit-manager.md

@@ -1,21 +1,21 @@
 ---
 name: commit-manager
-version: 3.1.0
-description: "AUTOMATICALLY invoke as the FINAL implementation agent when code changes are ready. Verifies security-auditor and quality-gate passed (HARD GATE — will NOT commit if vetoed), analyzes the diff for a precise conventional commit message, commits ONLY this session's files via `scope.ts commit` (atomic `git commit -o`, never bundles a peer's staged work; `git add -A` only in solo projects), pushes, and triggers the post-commit chain (documenter → domain-updater). Multi-instance safe: never bundles peer sessions' uncommitted files into your commit, and STOPS rather than falling back to `git add -A` when the session cannot be resolved. Supports branch-merge and direct-to-main flows. v3.1.0 (May-2026): atomic pathspec commit + safe (no -A) fallback + CLAUDE_SESSION_ID requirement."
+version: 3.2.0
+description: "AUTOMATICALLY invoke as the FINAL implementation agent when code changes are ready. Verifies security-auditor and quality-gate passed (HARD GATE — will NOT commit if vetoed), analyzes the diff for a precise conventional commit message, commits ONLY this session's files via `scope.ts commit` (atomic `git commit -o`, never bundles a peer's staged work; `git add -A` only in solo projects), pushes, verifies GitHub Actions for the pushed SHA (gh run list/watch — majority of projects use Actions), then triggers the post-commit chain (documenter → domain-updater). Multi-instance safe. v3.2.0: post-push CI verification before claiming success."
 model: sonnet
 tools: Read, Bash, Grep, Glob
-skills: git-workflow
+skills: git-workflow, ci-pipelines
 ---
 
-# Commit Manager Agent (v3.0.0 — gate-aware, diff-driven, per-instance scoped)
+# Commit Manager Agent (v3.2.0 — gate-aware, diff-driven, per-instance scoped, post-push CI)
 
-You are the **last gate before code enters the repo**. You verify upstream agents passed, compose a precise commit message from the actual diff, commit, push, and trigger the post-commit documentation chain.
+You are the **last gate before code enters the repo**. You verify upstream agents passed, compose a precise commit message from the actual diff, commit, push, **verify GitHub Actions for that push**, and trigger the post-commit documentation chain.
 
 ## Workflow position
 
 ```
 security-auditor ──┐
-quality-gate ──────┼──→ commit-manager (YOU) ──→ documenter ──→ domain-updater ──→ session end
+quality-gate ──────┼──→ commit-manager (YOU) ──→ [CI verify] ──→ documenter ──→ domain-updater ──→ session end
                    │         ▲
                    │         │ VETOED if findings open
                    └─────────┘
@@ -233,9 +233,48 @@ If still fails → **STOP**, print the error, and let the user decide. Do NOT fo
 
 ---
 
+## Step 5.5 — Verify GitHub Actions (REQUIRED after successful push)
+
+Local quality gates can be green while remote CI (matrix, Semgrep, deploy) fails. **Do not claim success until you know CI status** (or document an explicit skip).
+
+Most projects in this ecosystem use **GitHub Actions**. Recipe lives in `git-workflow` § Post-push CI and memory `post-push-ci-verification.md`.
+
+```bash
+SHA=$(git rev-parse HEAD)
+REMOTE=$(git remote get-url origin 2>/dev/null || true)
+
+# Skip only when clearly not applicable — state CI: skipped/<reason> in the report
+# - origin is not github.com
+# - gh missing or not authenticated
+# - no .github/workflows/ in the repo
+
+gh run list --commit "$SHA" --limit 10
+# Prefer watching the run(s) for this SHA (timeout ~10–15 min for typical CI):
+gh run list --commit "$SHA" --json databaseId,name,status,conclusion,url \
+  --jq '.[] | select(.status != "completed") | .databaseId' | while read -r id; do
+  [ -n "$id" ] && gh run watch "$id" --exit-status
+done
+# If all already completed, check conclusions:
+gh run list --commit "$SHA" --json name,conclusion,url \
+  --jq '.[] | "\(.conclusion)\t\(.name)\t\(.url)"'
+```
+
+### Decision matrix
+
+| Result | Action |
+|---|---|
+| All relevant runs `success` | Proceed to Step 6; report `CI: passed` (+ note deploy/release job if present) |
+| Any run `failure` / `cancelled` | **Report loudly** — print failing job URL + `gh run view <id> --log-failed` hint. Do **not** say “deployed successfully”. Still allow Step 6 (docs) but mark `CI: FAILED` |
+| Still `in_progress` after watch timeout | Report `CI: pending` + run URL; do not invent a green status |
+| Skip conditions above | Report `CI: skipped (<reason>)` once; continue |
+
+Deploy/release: if a workflow name contains `deploy`, `release`, `publish`, or `auto-release`, include its conclusion in the report (pass/fail/pending).
+
+---
+
 ## Step 6 — Trigger post-commit chain
 
-After successful push, inform the orchestrator that these agents should run next:
+After successful push **and** CI check (or explicit skip), inform the orchestrator that these agents should run next:
 
 ```
 ✅ Commit successful
@@ -243,6 +282,7 @@ Hash:    <short-sha>
 Branch:  <main>
 Subject: <subject line>
 Files:   <n> changed, <insertions>+, <deletions>-
+CI:      <passed|failed|pending|skipped>
 
 Next agents (in order):
   1. documenter  — map files + commits to domains
@@ -250,11 +290,11 @@ Next agents (in order):
                       (append-only LIFO, cap 10 — multi-instance safe)
 ```
 
-Do NOT run them yourself — the orchestrator or the user triggers them. Your job is done after push.
+Do NOT run documenter/domain-updater yourself — the orchestrator or the user triggers them. Your job is done after push **and** the CI check (or documented skip).
 
 ---
 
-## Step 7 — Report (deterministic, ≤ 10 lines)
+## Step 7 — Report (deterministic, ≤ 12 lines)
 
 ### Success
 
@@ -267,6 +307,8 @@ Subject:    <subject>
 Files:      <n> changed (<insertions>+, <deletions>-)
 Flow:       <branch-merge|direct-to-main>
 Push:       origin/<main>
+CI:         <passed|failed|pending|skipped> — <workflow names / URLs>
+Deploy:     <passed|failed|n/a|pending>
 Next:       documenter → domain-updater
 ```
 
@@ -293,12 +335,15 @@ Action:     <what the user should do>
 8. **TOKEN EFFICIENT** — use `--stat` first (cheap). Only `diff -U3` specific files when stat is ambiguous. Never read the full diff of 20+ files.
 9. **CLEAN STAGE** — verify no `.env`, `.DS_Store`, `*.log` are staged. Unstage them silently.
 10. **PUSH FAILURE = STOP** — retry once with `--rebase --autostash`. If still fails, stop and report. Never force push.
-11. **TRIGGER CHAIN** — always report which agents should run next (documenter → domain-updater). You do not run them.
-12. **NEVER REFRESH "Last Change"** — that section no longer exists. The downstream chain (`domain-updater`) PREPENDS to `## Recent Changes` (append-only LIFO). Do not generate `## Last Change` content in your commit messages or instructions.
+11. **POST-PUSH CI** — after every successful push to a GitHub remote with workflows, verify Actions for the pushed SHA (Step 5.5). Never claim deploy success without checking.
+12. **TRIGGER CHAIN** — always report which agents should run next (documenter → domain-updater). You do not run them.
+13. **NEVER REFRESH "Last Change"** — that section no longer exists. The downstream chain (`domain-updater`) PREPENDS to `## Recent Changes` (append-only LIFO). Do not generate `## Last Change` content in your commit messages or instructions.
 
 ## See Also
 
-- `git-workflow` skill — branch naming, conventional commits, merge strategies, HEREDOC examples
+- `git-workflow` skill — branch naming, conventional commits, **post-push CI verification**
+- Memory `post-push-ci-verification.md` — always-on checklist after commit/push
+- `ci-pipelines` skill — workflow authorship + how to read failing jobs
 - `scope.ts` (`.claude/hooks/scope.ts`) — per-instance staging tool used by Step 4a
 - `peers.ts` (`.claude/hooks/peers.ts`) — peer discovery CLI used by Step 1.5
 - `/commit-mine` slash command — interactive equivalent of this agent's Step 4a + Step 4b for manual use

package/stacks/_shared/commands/commit-mine.md

@@ -1,7 +1,7 @@
 ---
 name: commit-mine
-description: Commit ONLY this Claude session's edited files (multi-instance safe). Replaces raw `git add . && git commit` to prevent your commit from bundling a peer session's uncommitted changes.
-version: 1.1.0
+description: Commit ONLY this Claude session's edited files (multi-instance safe). Replaces raw `git add . && git commit` to prevent your commit from bundling a peer session's uncommitted changes. After --push, verify GitHub Actions for the SHA.
+version: 1.2.0
 ---
 
 # /commit-mine — Per-Instance Commit
@@ -34,11 +34,14 @@ files in the last 5 min unless you pass `--include-conflicted`.
 | 3 | **Review** the diff of your files | `npx tsx "$CLAUDE_PROJECT_DIR/.claude/hooks/scope.ts" diff` |
 | 4 | **Commit** — atomic, only your files | `npx tsx "$CLAUDE_PROJECT_DIR/.claude/hooks/scope.ts" commit "<message>"` |
 | 5 | **Push** (optional) | add `--push` to step 4, or `git push` |
+| 6 | **Verify GitHub Actions** (required if you pushed) | `gh run list --commit $(git rev-parse HEAD)` then `gh run watch` — see `git-workflow` § Post-push CI |
 
 > `scope stage` still exists for manual index inspection, but it is best-effort in a
 > shared worktree (a peer's staged files can linger). Prefer `scope commit` — it is the
 > only path that is atomic against a concurrent peer.
 
+> After `--push`, do **not** stop at “pushed”. Confirm Actions (and deploy/release jobs if any) before claiming success. Memory: `post-push-ci-verification.md`.
+
 ## Forbidden patterns (NEVER do these in a multi-instance project)
 
 | Command | Why forbidden |

package/stacks/_shared/commands/feature.md

@@ -1,7 +1,7 @@
 ---
 name: feature
-description: Start a new feature with the full workflow (research → plan → implement → hygiene → test → security → quality → commit → docs).
-version: 1.2.0
+description: Start a new feature with the full workflow (research → plan → implement → hygiene → test → security → quality → commit → CI verify → docs).
+version: 1.3.0
 ---
 
 # /feature — Start New Feature
@@ -19,10 +19,11 @@ Execute in order — do not skip steps. Steps 6–7 have **VETO power** over com
 | 5 | **Test** — unit + e2e | `tester` |
 | 6 | **Security** — adversarial audit | `security-auditor` (VETO) |
 | 7 | **Quality** — typecheck → lint → test → build | `quality-gate` |
-| 8 | **Commit** — gate-aware, diff-driven message | `commit-manager` |
-| 9 | **Map** — files + commits → domains | `documenter` |
-| 10 | **Wisdom + Recent Changes** — record learnings, PREPEND new `### YYYY-MM-DD · branch · vX.Y.Z` entry to `CLAUDE.md` `## Recent Changes` (append-only LIFO, cap 10) | `domain-updater` |
+| 8 | **Commit + push** — gate-aware, diff-driven message | `commit-manager` |
+| 9 | **Verify GitHub Actions** — `gh run list/watch` for the pushed SHA; report deploy/release if present | `commit-manager` Step 5.5 · `git-workflow` · memory `post-push-ci-verification` |
+| 10 | **Map** — files + commits → domains | `documenter` |
+| 11 | **Wisdom + Recent Changes** — record learnings, PREPEND new `### YYYY-MM-DD · branch · vX.Y.Z` entry to `CLAUDE.md` `## Recent Changes` (append-only LIFO, cap 10) | `domain-updater` |
 
-If `security-auditor` returns CRITICAL/HIGH/MEDIUM, fix before re-running step 6. Steps 9–10 run AFTER push and never before.
+If `security-auditor` returns CRITICAL/HIGH/MEDIUM, fix before re-running step 6. Steps 10–11 run AFTER push (and CI check) and never before.
 
-**Multi-instance note:** `commit-manager` v3.0.0 stages only THIS session's files via `scope.ts` when `.claude/state/` is present — peers' uncommitted files are never bundled into your commit. For a manual / interactive equivalent of Step 8, use `/commit-mine` (skip `/feature` from Step 8 onward).
+**Multi-instance note:** `commit-manager` v3.2.0+ stages only THIS session's files via `scope.ts` when `.claude/state/` is present — peers' uncommitted files are never bundled into your commit. For a manual / interactive equivalent of Step 8, use `/commit-mine` (then still run Step 9 if you pushed).

package/stacks/_shared/commands/fix.md

@@ -1,7 +1,7 @@
 ---
 name: fix
-description: Fix a bug — reproduce, isolate, minimal fix, fix-induced dead-code hygiene, regression test, security check, commit, record wisdom.
-version: 1.2.0
+description: Fix a bug — reproduce, isolate, minimal fix, fix-induced dead-code hygiene, regression test, security check, commit, verify GitHub Actions, record wisdom.
+version: 1.3.0
 ---
 
 # /fix — Fix Bug
@@ -17,10 +17,11 @@ Always read `.claude/config/active-project.json` first.
 | 5 | **Verify** — re-run the regression test + the wider suite | `tester` |
 | 6 | **Security** — only if the bug touched auth / input / secrets / SSRF surface | `security-auditor` (VETO) |
 | 7 | **Quality gate** — typecheck → lint → test → build | `quality-gate` |
-| 8 | **Commit** — `fix(scope): <subject>`, diff-driven body, per-instance scoped staging | `commit-manager` v3.0.0 |
-| 9 | **Map** — files + commit → domain | `documenter` v3.0.0 |
-| 10 | **Wisdom + Recent Changes entry** — append to domain `## Problems & Solutions` (symptom + root cause + fix + prevention + skill ref) AND PREPEND `### YYYY-MM-DD · branch · fix-tag` to `CLAUDE.md` `## Recent Changes` | `domain-updater` v3.0.0 |
+| 8 | **Commit + push** — `fix(scope): <subject>`, diff-driven body, per-instance scoped staging | `commit-manager` v3.2.0 |
+| 9 | **Verify GitHub Actions** — `gh run list/watch` for the pushed SHA; report deploy if present | `git-workflow` · memory `post-push-ci-verification` |
+| 10 | **Map** — files + commit → domain | `documenter` v3.0.0 |
+| 11 | **Wisdom + Recent Changes entry** — append to domain `## Problems & Solutions` (symptom + root cause + fix + prevention + skill ref) AND PREPEND `### YYYY-MM-DD · branch · fix-tag` to `CLAUDE.md` `## Recent Changes` | `domain-updater` v3.0.0 |
 
 `domain-updater` deduplicates by symptom/root-cause. If the same bug recurred, it appends a "Recurrence" note instead of a duplicate entry.
 
-**Multi-instance note:** Step 8 stages only THIS session's files via `scope.ts` when `.claude/state/` is present (peers' uncommitted files are never bundled). For a manual / interactive Step 8 (no chain auto-trigger), use `/commit-mine` instead.
+**Multi-instance note:** Step 8 stages only THIS session's files via `scope.ts` when `.claude/state/` is present (peers' uncommitted files are never bundled). For a manual / interactive Step 8 (no chain auto-trigger), use `/commit-mine` — then still run Step 9 if you pushed.

package/stacks/_shared/hooks/user-prompt-submit.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// @sv-version: 1.3.0
+// @sv-version: 1.4.0
 /**
  * UserPromptSubmit Hook — Start Vibing Stacks
  *
@@ -10,6 +10,8 @@
  *     peer messages reach the user before this turn runs, and warn if active
  *     peers exist.
  *
+ * v1.4.0: after commit/push, verify GitHub Actions (gh run list/watch) before
+ * claiming deploy success — memory post-push-ci-verification + commit-manager 5.5.
  * v1.3.0: workflow adds dead-code hygiene step (skill `dead-code-hygiene`) between
  * WORK and quality gates — remove inert legacy paths before commit.
  * v1.2.0: workflow guidance now points at `## Recent Changes` (append-only LIFO)
@@ -169,7 +171,7 @@ async function main(): Promise<void> {
 
 4. Run quality gates: ${qualityCmd}
 
-5. COMMIT using conventional commits via commit-manager agent (v3.0.0+: stages only THIS session's files via scope.ts when .claude/state/ exists — peers' uncommitted files are never bundled).
+5. COMMIT using conventional commits via commit-manager agent (v3.2.0+: stages only THIS session's files via scope.ts when .claude/state/ exists — peers' uncommitted files are never bundled). After push, VERIFY GitHub Actions for the SHA (gh run list/watch) — do not claim deploy success without checking (memory: post-push-ci-verification).
 
 6. UPDATE CLAUDE.md:
    a. PREPEND a new entry under "## Recent Changes" — heading exactly:

package/stacks/_shared/memories/post-push-ci-verification.md

@@ -0,0 +1,51 @@
+---
+version: 1.0.0
+---
+
+# Memory: Post-Push CI Verification (GitHub Actions)
+
+> **ALWAYS LOAD** — After any `git push` to a GitHub remote, verify **GitHub Actions** for that commit before claiming the change is validated or deployed. Most projects in this ecosystem use Actions.
+
+---
+
+## Declared purpose
+
+Agents routinely stop at “pushed to origin” while CI (or deploy/release) is still red. This memory makes post-push verification part of the default contract.
+
+---
+
+## What to check after push
+
+1. **Runs for the pushed SHA** — `gh run list --commit $(git rev-parse HEAD)`
+2. **Wait for completion** — `gh run watch <id> --exit-status` for in-progress runs
+3. **Conclusions** — all required workflows `success` (or document failure)
+4. **Deploy/release** — if a job/workflow is named deploy / release / publish / auto-release, report its result separately
+5. **On failure** — surface the run URL + `gh run view <id> --log-failed`; do **not** say “deployed successfully”
+
+Load skill `git-workflow` (§ Post-push CI) and agent `commit-manager` Step 5.5 for the full recipe.
+
+---
+
+## Explicit rules
+
+| Situation | Required behavior |
+|---|---|
+| GitHub remote + `.github/workflows/` present | Verify Actions after push |
+| CI failed | Report `CI: FAILED` + URL; fix or escalate — never invent green |
+| CI pending / timeout | Report `CI: pending` + URL |
+| Not GitHub / no `gh` / no workflows | Report `CI: skipped (<reason>)` once |
+
+---
+
+## Out of scope
+
+- Replacing local `quality-gate` (still required **before** commit)
+- Force-pushing to “fix” CI
+- Claiming npm/production deploy success without a green deploy/release job (or user confirmation)
+
+---
+
+## See Also
+
+- Agent: `commit-manager` v3.2.0+ (Step 5.5)
+- Skills: `git-workflow`, `ci-pipelines`

package/stacks/_shared/skills/ci-pipelines/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ci-pipelines
-version: 1.0.0
-description: GitHub Actions pipelines for typecheck, lint, test, security scan, build, and release. Stack-aware templates live in stacks/<stack>/workflows/.
+version: 1.1.0
+description: GitHub Actions pipelines for typecheck, lint, test, security scan, build, and release. Also covers verifying runs after git push (gh run list/watch). Stack-aware templates live in stacks/<stack>/workflows/.
 ---
 
 # CI Pipelines
@@ -159,8 +159,22 @@ jobs:
 | Workflow with `permissions: write-all` | Overly broad, supply chain risk |
 | Long-lived cloud creds in repo secrets | Use OIDC instead |
 
+## Verify runs after push
+
+Authoring workflows is not enough — after `git push`, confirm the run for that SHA. Full recipe: `git-workflow` § Post-push CI and `commit-manager` Step 5.5.
+
+```bash
+gh run list --commit "$(git rev-parse HEAD)" --limit 10
+gh run watch <id> --exit-status          # when still in_progress
+gh run view <id> --log-failed            # when conclusion=failure
+```
+
+Map deploy/release success only when the job that publishes/deploys is green (not merely “CI started”).
+
 ## See Also
 
 - `secrets-management` — repo secrets & OIDC patterns
 - `quality-gate` — local quality gates that mirror CI
-- `git-workflow` — branch + commit conventions CI relies on
+- `git-workflow` — branch + commit conventions + post-push verification
+- Memory `post-push-ci-verification.md` — always-on checklist after push
+- `commit-manager` — enforces Step 5.5 after every push

package/stacks/_shared/skills/git-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: git-workflow
-version: 2.0.0
-description: "Git workflow conventions used by commit-manager v2.0.0+: Conventional Commits (no AI-attribution footers), branch naming, direct-to-main vs feature-branch flow, end-on-main rule, push policy, never force-push main, signed commits encouraged. Invoke when starting a feature, creating commits, pushing, or wiring git-related hooks."
+version: 2.1.0
+description: "Git workflow conventions used by commit-manager v3.2.0+: Conventional Commits (no AI-attribution footers), branch naming, direct-to-main vs feature-branch flow, end-on-main rule, push policy, post-push GitHub Actions verification (gh run list/watch), never force-push main, signed commits encouraged. Invoke when starting a feature, creating commits, pushing, or wiring git-related hooks."
 ---
 
 # Git Workflow
@@ -127,6 +127,41 @@ End state in **both flows**: clean tree, on `main`, in sync with `origin/main`.
 - [ ] Conventional commit message drafted
 - [ ] Push target confirmed (`origin main` vs `origin feature/*`)
 
+## 5.5. Post-push CI verification (GitHub Actions)
+
+**After every successful `git push` to a GitHub remote**, verify Actions for that commit. Local gates ≠ remote CI. Majority of projects here use GitHub Actions. See memory `post-push-ci-verification.md` and `commit-manager` Step 5.5.
+
+```bash
+SHA=$(git rev-parse HEAD)
+
+# List runs for this commit
+gh run list --commit "$SHA" --limit 10
+
+# Watch incomplete runs until they finish (fail the shell if a run fails)
+for id in $(gh run list --commit "$SHA" --json databaseId,status \
+  --jq '.[] | select(.status != "completed") | .databaseId'); do
+  gh run watch "$id" --exit-status
+done
+
+# Summarize conclusions
+gh run list --commit "$SHA" --json name,conclusion,url \
+  --jq '.[] | "\(.conclusion)\t\(.name)\t\(.url)"'
+```
+
+On failure:
+
+```bash
+gh run view <run-id> --log-failed   # or open the URL from gh run list
+```
+
+| Skip when | Report as |
+|---|---|
+| `origin` is not GitHub | `CI: skipped (non-GitHub remote)` |
+| `gh` missing / not authenticated | `CI: skipped (gh unavailable)` |
+| No `.github/workflows/` | `CI: skipped (no workflows)` |
+
+Never claim **deploy / release / npm publish** success unless the matching workflow job concluded `success` (or the user confirmed outside CI).
+
 ## 6. Tags & releases
 
 ```bash
@@ -153,11 +188,13 @@ Semver: bump `MAJOR.MINOR.PATCH` per breaking/feature/fix.
 - **NEVER** `--no-verify` to bypass hooks
 - **ALWAYS** Conventional Commits, no AI-attribution footers
 - **ALWAYS** end on `main` with a clean tree (Stop validator enforces)
+- **ALWAYS** verify GitHub Actions after push (or document an explicit skip)
 - **ONE** feature per branch (or per direct-to-main commit batch)
 
 ## See Also
 
-- `commit-manager` agent — drives the message + push pipeline
-- `quality-gate` — the gate the commit-manager waits for
+- `commit-manager` agent — drives the message + push + **CI verify** pipeline
+- Memory `post-push-ci-verification.md` — always-on post-push checklist
+- `quality-gate` — the local gate the commit-manager waits for before commit
 - `secrets-management` — gitleaks 3-layer (pre-commit, CI, push protection)
-- `ci-pipelines` — branch-protection rules that mirror this skill
+- `ci-pipelines` — workflow authorship + failing-job triage