toga-ai 1.0.980 → 1.0.981

package/.claude/settings.json

@@ -287,7 +287,6 @@
     ],
     "ask": [
       "mcp__clickup__clickup_update_task",
-      "mcp__clickup__clickup_create_comment",
       "Bash(git push *)"
     ],
     "deny": [

package/knowledge/standalone/apps/claude/workflows/clickup-ticket-workflow.md

@@ -114,6 +114,9 @@ All tested 2026-10-08:
   replace `/kickoff`, `/capture`, `/plan-ticket`, `/work-ticket`, `/rework-ticket`. (jcardinal)
 - 2026-10-08 — Branch claims always re-checked fresh; `/finish` runs `/commit` on yes and
   guides `gh auth login`. (jcardinal)
+- 2026-10-08 — Claude posts the PM comment and writes PR/commit/KB summaries without asking
+  for approval; `clickup_create_comment` removed from permissions.ask. Field changes and
+  pushes still ask. (jcardinal)
 
 ## Related
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.980",
+  "version": "1.0.981",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/rules/common/git-workflow.md

@@ -34,7 +34,9 @@ describes. It does not authorize publishing anything else in the session.
 - `/commit` — local commits of only the files this session changed. Never pushes.
 - `/finish` — the KB push to `_main`, the ticket-branch pushes, the PRs, and the ticket writes.
   If this session's files are uncommitted, `/finish` asks once and, on "yes", runs the
-  `/commit` steps itself (same rules as `/commit`).
+  `/commit` steps itself (same rules as `/commit`). Claude writes and posts the PM comment,
+  PR subject/body, commit notes, and KB summary itself — no approval prompt (secret scan
+  still runs). Ticket field changes still need the one approval list; pushes still ask.
 - `/ship`, `/land-and-deploy` — the commits, pushes, and PRs they describe.
 
 Force-pushing is never automatic in any repo, including the knowledge repo.

package/scripts/install.js

@@ -436,7 +436,10 @@ const RETIRED_TOGA_HOOKS = ['kickoff-gate.js'];
 
 // Permission rules the TOGA template once shipped and no longer wants. Only exact TOGA-owned
 // strings go here — a developer's own rules are never removed.
-const RETIRED_TOGA_PERMISSIONS = { ask: ['mcp__clickup__clickup_create_task_comment'] };
+const RETIRED_TOGA_PERMISSIONS = { ask: [
+  'mcp__clickup__clickup_create_task_comment',
+  'mcp__clickup__clickup_create_comment',
+] };
 
 function mergeSettings(claudeDir, sourceDir) {
   const templatePath = path.join(sourceDir, '.claude', 'settings.json');

package/skills/finish/SKILL.md

@@ -9,7 +9,11 @@ Order: **Part 1** KB capture (always) → **Part 2** ticket field check (always,
 a ticket) → **Part 3** "Is this ticket finished?" → push, PRs, PM comment, status.
 
 Keep the main thread lean: the KB write pipeline runs in the `session-capture` subagent, and
-ClickUp reads run in the `ticket-reader` subagent. The main thread distills, asks, and approves.
+ClickUp reads run in the `ticket-reader` subagent. The main thread distills and asks only for real decisions.
+
+Claude writes and posts all summary text itself — PM comment, PR subject and body, commit
+notes, KB capture summary. Never ask the developer to approve that wording. Approvals are only
+for real decisions: ticket field changes (one list), ELEVATED KB docs, and pushes.
 
 ## Step 0 — Rules, helpers, session ticket
 
@@ -31,8 +35,8 @@ Never: force-push, push any other branch, commit source code (that is `/commit`)
 **Has Code Changes** field (`af9eaba8-d3d3-4769-b8bc-28de78b04570` — worker2 owns it), write
 "Pseudocode Review" / "Pseudocode Required", touch any other ticket, or use the old read-only
 `mcp__claude_ai_ClickUP_for_Dev__*` tools. The `start-gate` hook blocks every other ClickUp
-write (other tools, other fields, other tickets). Claude Code asks the developer before every
-ClickUp write — that prompt is expected; it is the approval gate. `git push` may also ask for
+write (other tools, other fields, other tickets). Claude Code asks before `clickup_update_task`
+(field changes) — that prompt is expected. The PM comment posts without a prompt. `git push` may also ask for
 permission — that is expected too.
 
 **Helpers** (both print JSON):
@@ -428,7 +432,7 @@ Exit 0 + `{ok:true}` = clean. Exit 1 + `{ok:false, hits:[...]}` = a hit: show th
 the hit types (it never prints the values), fix the text, and scan again. Exit 2 = the file
 could not be read — fix the path. Never post until it prints `{ok:true}`.
 
-## Step 15 — PM comment (developer approves the text first)
+## Step 15 — PM comment (Claude writes and posts it — no approval)
 
 Draft a short comment for the PM and release notes. Plain words, no code dumps, no secrets,
 no local paths:
@@ -443,15 +447,15 @@ no local paths:
 **Ticket fields changed by Claude:** <from Step 10 — or "None">
 ```
 
-Show it; after the developer approves (edit if asked), write the text to a temp file
+Do not ask the developer to approve it. Write the text to a temp file
 (`toga-comment-<TICKET>.md` in the OS temp dir), run the **Secret scan** on it, delete the
-file, then post:
+file. Stop only on a hit. Then post it, and show the posted text in the Step 17 report:
 
 ```
 mcp__clickup__clickup_create_comment
   entity_type: "task"
   entity_id: "<internalId>"
-  comment_text: "<approved markdown, max 40000 characters>"
+  comment_text: "<markdown, max 40000 characters>"
 ```
 
 ## Step 16 — Set the status
@@ -472,7 +476,7 @@ Short list:
 1. KB: publish status (Step 5).
 2. Ticket fields changed (or "none").
 3. PRs: one url per repo, and which got `re-review`.
-4. PM comment: posted (yes/no).
+4. PM comment: posted (yes/no), with the posted text.
 5. Status: `development finished` (or why not).
 6. Anything manual the developer must still do — as a numbered list.