toga-ai 1.0.979 → 1.0.981

package/.claude/settings.json

@@ -287,7 +287,6 @@
     ],
     "ask": [
       "mcp__clickup__clickup_update_task",
-      "mcp__clickup__clickup_create_comment",
       "Bash(git push *)"
     ],
     "deny": [

package/knowledge/standalone/apps/claude/workflows/clickup-ticket-workflow.md

@@ -101,11 +101,22 @@ All tested 2026-10-08:
   `_production`, varies) — resolve with `gh repo view <owner/repo> --json defaultBranchRef`.
 - **The KB repo (`toga-tech`) works on `_main`.** No branch check and no PRs there; `/finish`
   still does the ticket check.
+- **Re-check the branch, never repeat it.** When the developer says they switched (or before
+  repeating any mismatch), run `branch-check` / `git -C <repo> branch --show-current` fresh in
+  that turn. Never state a branch from memory or an earlier check.
+- **`/finish` offers to commit.** Uncommitted session files → it asks once "Run /commit for them
+  now?"; yes = it runs the `/commit` steps itself, then continues; no = stop. `gh` not logged in
+  → "Run `gh auth login` in a terminal, then tell me 'done'", then re-check `gh auth status`.
 
 ## Change history
 
 - 2026-10-08 — Created: ClickUp-tied sessions (`/start`, `/commit`, `/pseudocode`, `/finish`)
   replace `/kickoff`, `/capture`, `/plan-ticket`, `/work-ticket`, `/rework-ticket`. (jcardinal)
+- 2026-10-08 — Branch claims always re-checked fresh; `/finish` runs `/commit` on yes and
+  guides `gh auth login`. (jcardinal)
+- 2026-10-08 — Claude posts the PM comment and writes PR/commit/KB summaries without asking
+  for approval; `clickup_create_comment` removed from permissions.ask. Field changes and
+  pushes still ask. (jcardinal)
 
 ## Related
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.979",
+  "version": "1.0.981",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/rules/common/git-workflow.md

@@ -33,6 +33,10 @@ describes. It does not authorize publishing anything else in the session.
 
 - `/commit` — local commits of only the files this session changed. Never pushes.
 - `/finish` — the KB push to `_main`, the ticket-branch pushes, the PRs, and the ticket writes.
+  If this session's files are uncommitted, `/finish` asks once and, on "yes", runs the
+  `/commit` steps itself (same rules as `/commit`). Claude writes and posts the PM comment,
+  PR subject/body, commit notes, and KB summary itself — no approval prompt (secret scan
+  still runs). Ticket field changes still need the one approval list; pushes still ask.
 - `/ship`, `/land-and-deploy` — the commits, pushes, and PRs they describe.
 
 Force-pushing is never automatic in any repo, including the knowledge repo.
@@ -92,6 +96,10 @@ git -C <repo> log -1 --format="%h %ad %s" --date=short -- <file>
 - For push state, check `git -C <repo> status -sb` (ahead/behind) — do not assume.
 - If Claude did not check, it says **nothing** about commit or push state. No habit reminders
   like "still not committed" at the end of a summary.
+- **Branch state too.** Never say a repo is "on branch X" or "on the wrong branch" from memory
+  or an earlier check. Run `git -C <repo> branch --show-current` (or `start-helper.js
+  branch-check`) fresh in the same turn first. When the developer says they switched, re-check
+  before you answer.
 
 ## Branch protection
 

package/scripts/install.js

@@ -436,7 +436,10 @@ const RETIRED_TOGA_HOOKS = ['kickoff-gate.js'];
 
 // Permission rules the TOGA template once shipped and no longer wants. Only exact TOGA-owned
 // strings go here — a developer's own rules are never removed.
-const RETIRED_TOGA_PERMISSIONS = { ask: ['mcp__clickup__clickup_create_task_comment'] };
+const RETIRED_TOGA_PERMISSIONS = { ask: [
+  'mcp__clickup__clickup_create_task_comment',
+  'mcp__clickup__clickup_create_comment',
+] };
 
 function mergeSettings(claudeDir, sourceDir) {
   const templatePath = path.join(sourceDir, '.claude', 'settings.json');

package/skills/commit/SKILL.md

@@ -37,7 +37,8 @@ Run `helper status --session=<id>`. For each repo, tell the developer in plain w
 4. **Branch mismatch:** `branchMismatch` files were last edited on another branch
    (`entryBranch`). They are NOT in `toCommit`. If the list is not empty, **stop** for that
    repo: say which files were edited on which branch, and ask the developer to switch
-   branches themselves.
+   branches themselves. When they say they switched, run `status` again fresh in that turn
+   and report only what it shows now — never repeat a mismatch from memory.
 5. **Possibly yours from before a resume:** list `sameBranchOtherSessions` (time, file count).
    If the developer says one is theirs, run `status` with that id too and merge the lists.
 6. **Ticket:** use the repo's `ticket`. `ticketSource` says where it came from:

package/skills/finish/SKILL.md

@@ -9,7 +9,11 @@ Order: **Part 1** KB capture (always) → **Part 2** ticket field check (always,
 a ticket) → **Part 3** "Is this ticket finished?" → push, PRs, PM comment, status.
 
 Keep the main thread lean: the KB write pipeline runs in the `session-capture` subagent, and
-ClickUp reads run in the `ticket-reader` subagent. The main thread distills, asks, and approves.
+ClickUp reads run in the `ticket-reader` subagent. The main thread distills and asks only for real decisions.
+
+Claude writes and posts all summary text itself — PM comment, PR subject and body, commit
+notes, KB capture summary. Never ask the developer to approve that wording. Approvals are only
+for real decisions: ticket field changes (one list), ELEVATED KB docs, and pushes.
 
 ## Step 0 — Rules, helpers, session ticket
 
@@ -31,8 +35,8 @@ Never: force-push, push any other branch, commit source code (that is `/commit`)
 **Has Code Changes** field (`af9eaba8-d3d3-4769-b8bc-28de78b04570` — worker2 owns it), write
 "Pseudocode Review" / "Pseudocode Required", touch any other ticket, or use the old read-only
 `mcp__claude_ai_ClickUP_for_Dev__*` tools. The `start-gate` hook blocks every other ClickUp
-write (other tools, other fields, other tickets). Claude Code asks the developer before every
-ClickUp write — that prompt is expected; it is the approval gate. `git push` may also ask for
+write (other tools, other fields, other tickets). Claude Code asks before `clickup_update_task`
+(field changes) — that prompt is expected. The PM comment posts without a prompt. `git push` may also ask for
 permission — that is expected too.
 
 **Helpers** (both print JSON):
@@ -322,8 +326,10 @@ comment.
 development finished)"
 
 **No** → stop. Report what is left local: for each repo from `START repos-with-work`, the
-unpushed commit count, and any uncommitted Claude changes from `COMMIT status`. Say:
-"Run /finish again when the ticket is done."
+unpushed commit count, and any uncommitted Claude changes from `COMMIT status`. If there are
+uncommitted Claude changes, ask once: "These files aren't committed: <list>. Run /commit for
+them now?" Yes → run the `/commit` skill's steps (same rules as `skills/commit/SKILL.md`).
+Then say: "Run /finish again when the ticket is done."
 
 **KB / harness repo work (toga-tech / agilantsolutions/claude, on `_main`):** `knowledge/` was
 published in Part 1. Other harness files committed with `/commit` are pushed now:
@@ -343,10 +349,15 @@ skip Steps 12–14 and go to Step 15 (PM comment) and Step 16 (status).
    `origin/<TICKET>` if pushed). This includes commits from other sessions — that is intended.
    Keep for each: repo path, `owner/repo`, ahead count, pushed or not.
 2. `COMMIT status --session=<sid> --root="$CLAUDE_PROJECT_DIR"`. If any repo has `toCommit`
-   files: stop and say "There are uncommitted changes from this session in `<repo>`. Run
-   /commit first, then /finish again." (Changes outside Claude's list, `otherChanged`, are the
-   developer's — mention them, do not block.)
-3. If `gh auth status` fails: stop and say "Run `gh auth login`, then /finish again."
+   files: ask once — "These files aren't committed: <list>. Run /commit for them now?"
+   **Yes** → run the `/commit` skill's steps yourself (same rules as `skills/commit/SKILL.md`:
+   only this session's files, the `Claude-Notes: v1` format), then re-run step 1 and continue.
+   **No** → stop and say "Run /finish again when they are committed." (Changes outside
+   Claude's list, `otherChanged`, are the developer's — mention them, do not block.)
+3. If `gh auth status` fails, say exactly: "Run `gh auth login` in a terminal, then tell me
+   'done'". When they say done, run `gh auth status` again and continue only if it passes.
+   Before saying any repo is on the wrong branch, re-check it fresh in that turn
+   (`git -C <repo> branch --show-current`) — never from memory or an earlier check.
 4. No repo with work → check whether this session committed on another branch. Per repo under
    the root: `git -C "<repo>" log --all --grep="Claude-Session: <sid>" --format=%h`, then for
    each hash `git -C "<repo>" branch --contains <hash>`. If any show up, list repo + branch,
@@ -421,7 +432,7 @@ Exit 0 + `{ok:true}` = clean. Exit 1 + `{ok:false, hits:[...]}` = a hit: show th
 the hit types (it never prints the values), fix the text, and scan again. Exit 2 = the file
 could not be read — fix the path. Never post until it prints `{ok:true}`.
 
-## Step 15 — PM comment (developer approves the text first)
+## Step 15 — PM comment (Claude writes and posts it — no approval)
 
 Draft a short comment for the PM and release notes. Plain words, no code dumps, no secrets,
 no local paths:
@@ -436,15 +447,15 @@ no local paths:
 **Ticket fields changed by Claude:** <from Step 10 — or "None">
 ```
 
-Show it; after the developer approves (edit if asked), write the text to a temp file
+Do not ask the developer to approve it. Write the text to a temp file
 (`toga-comment-<TICKET>.md` in the OS temp dir), run the **Secret scan** on it, delete the
-file, then post:
+file. Stop only on a hit. Then post it, and show the posted text in the Step 17 report:
 
 ```
 mcp__clickup__clickup_create_comment
   entity_type: "task"
   entity_id: "<internalId>"
-  comment_text: "<approved markdown, max 40000 characters>"
+  comment_text: "<markdown, max 40000 characters>"
 ```
 
 ## Step 16 — Set the status
@@ -465,7 +476,7 @@ Short list:
 1. KB: publish status (Step 5).
 2. Ticket fields changed (or "none").
 3. PRs: one url per repo, and which got `re-review`.
-4. PM comment: posted (yes/no).
+4. PM comment: posted (yes/no), with the posted text.
 5. Status: `development finished` (or why not).
 6. Anything manual the developer must still do — as a numbered list.
 

package/skills/start/SKILL.md

@@ -112,6 +112,10 @@ explicit "continue anyway":
 node ".../start-helper.js" override-branch --session <sid>
 ```
 
+**Re-check, never repeat.** When the developer says they switched — or before you repeat any
+mismatch — run `branch-check` again, fresh, in that same turn. Report only what it shows now.
+Never state a repo's branch from memory or from an earlier check.
+
 ## Step 5 — GitHub login (warn only)
 
 Run `gh auth status`. If not logged in, say: "Run `gh auth login` before /finish." Keep going.