toga-ai 1.0.980 → 1.0.982

package/.claude/settings.json

@@ -287,7 +287,6 @@
     ],
     "ask": [
       "mcp__clickup__clickup_update_task",
-      "mcp__clickup__clickup_create_comment",
       "Bash(git push *)"
     ],
     "deny": [

package/knowledge/2.0/apps/worker2/INDEX.md

@@ -72,4 +72,4 @@
 | [PHP Runtime Upgrade on Elastic Beanstalk (worker2 8.3 → 8.5 + PhpSpreadsheet 1.x → 3.x)](workflows/php-runtime-upgrade-dependency-audit.md) | Reusable checklist for moving a TOGA repo across an EB PHP runtime jump (worker2 8.3 → 8.5 + PhpSpreadsheet 1.x → 3.x); open before any runtime bump or when a c |
 | [Running worker2 locally against real NetSuite (and what EB does instead)](workflows/running-worker2-locally.md) | Boot worker2 on a dev machine to run a real worker action against live NetSuite + a local Forecast DB; open when local boot fails or before any local NetSuite r |
 | [Repointing the Sprint Tooling at a New ClickUp Sprints Folder (+ table reset)](workflows/sprint-clickup-folder-repoint.md) | Move worker2's sprint tooling onto a new ClickUp "True Dev Sprints" folder and reset the Team sprint tables; open when the sprints folder id changes. |
-| [Ticket → ClickUp Pseudocode Planning (Talos-grounded)](workflows/ticket-to-pseudocode-planning.md) | Procedure to turn a ClickUp ticket into a reviewed, formatted plan posted to its `📝 Pseudocode` field (ClickUp + codebase + Talos); open when planning a ticket |
+| [Ticket → ClickUp Pseudocode Planning (Talos-grounded)](workflows/ticket-to-pseudocode-planning.md) | Retired procedure (`/plan-ticket` + `/work-ticket`) that planned a ClickUp ticket into its `📝 Pseudocode` field; open only for history. |

package/knowledge/2.0/apps/worker2/features/clickup-github-autolink.md

@@ -30,8 +30,15 @@ How ClickUp surfaces branches/PRs/commits in a ticket's GitHub tab and the branc
 
 - **Bare ticket-id branch name is now the git-workflow rule** (`rules/common/git-workflow.md`, 2026-10-08) — a `feature/…` prefix breaks ClickUp's native auto-link, which matches on the bare ticket id. Confirmed against live repos already on `TRUE-79142` (worker) and `TRUE-77219` (api2).
 
+- **If PRs stop linking, the integration was disconnected** (it was, until 2026-10-08). Fix:
+  1. ClickUp → Settings → App Center → GitHub → Reconnect (authorize as the `agilantgit` GitHub account; workspace-level).
+  2. GitHub Settings → "Connect Repositories to Spaces": add each repo AND link it to the **Development** space. A repo not linked to that space never links its PRs.
+  3. Repos added 2026-10-08: worker2, dbchanges2, toga25-desk, toga25-iq, toga25-blox, toga25-supply, toga2-commerce, toga2-supply, toga2-template, toga-blox-npm, saml, forward, apiproxy (`test` and `claude` skipped). A PR titled with the ticket id then linked automatically (verified).
+- **Settings:** leave "auto-generated branch name" as `:taskId:`. Do not turn on "Update Task Status from GitHub" — worker2 owns status automation.
+
 ## Change history
 
+- 2026-10-08 — Added reconnect fix, Development-space repo linking, and settings to leave alone. (jcardinal)
 - 2026-10-08 — `/work-ticket` and `/plan-ticket` retired; `/finish` opens the PRs. PR title = ticket id first; base = repo default branch; git-workflow now uses bare ticket-id branches. (jcardinal)
 
 ## Related

package/knowledge/standalone/apps/claude/workflows/clickup-ticket-workflow.md

@@ -74,7 +74,7 @@ Write values are strings: drop_down = option uuid; labels = JSON array string of
 
 1. `claude mcp add --scope user --transport http clickup https://mcp.clickup.com/mcp`
 2. In Claude Code, run `/mcp` and sign in to `clickup`.
-3. `gh auth login` (needed by `/finish` for PRs).
+3. `gh auth login` (needed by `/finish` for PRs; `gh` is often installed but not logged in).
 4. `npx toga-ai` in the workspace (installs the skills, the hook, and the settings).
 
 ## Gotchas
@@ -87,8 +87,11 @@ All tested 2026-10-08:
   headings, numbered steps, indented sub-points, no markdown symbols (no #, *, backticks, or _).
 - **The MCP cannot add a new option** to a labels or drop_down field. A truly new value: the
   developer adds it in ClickUp under that field, then Claude sets it.
-- **`clickup_get_task` with custom fields returns ~90k characters** (every field carries its
-  full option list). Only the `ticket-reader` agent does that read. Drop_down values come back
+- **`clickup_get_task` with custom fields returns ~76k characters** (every field carries its
+  full option list). Claude Code then replaces the tool result with "Output has been saved to
+  <file>". So the `ticket-reader` does a small read first, and `start-gate` reads the saved file
+  only from `~/.claude/projects/*/tool-results/`. Debug: env `TOGA_START_GATE_DEBUG=1` writes
+  `gate-debug.log` in the sessions dir. Only the `ticket-reader` agent does the full read. Drop_down values come back
   as an orderindex — map them through `type_config.options`.
 - **Done status is `development finished`** (lowercase; valid on the Dev Sprints lists).
 - **The ClickUp GitHub integration works:** a PR whose title starts with the ticket id auto-links.
@@ -108,12 +111,21 @@ All tested 2026-10-08:
   now?"; yes = it runs the `/commit` steps itself, then continues; no = stop. `gh` not logged in
   → "Run `gh auth login` in a terminal, then tell me 'done'", then re-check `gh auth status`.
 
+- **The PR summary comment comes from a GitHub Action:** `.github/workflows/pr-summary.yml` +
+  `ci/pr-review/`, built from the `/commit` notes. Re-run it with the `re-review` label. Setup:
+  `ci/pr-review/SETUP.md`. Still pending: CODEOWNERS, the protected `pr-summary-v1` tag, and the
+  caller file in each app repo.
+
 ## Change history
 
 - 2026-10-08 — Created: ClickUp-tied sessions (`/start`, `/commit`, `/pseudocode`, `/finish`)
   replace `/kickoff`, `/capture`, `/plan-ticket`, `/work-ticket`, `/rework-ticket`. (jcardinal)
 - 2026-10-08 — Branch claims always re-checked fresh; `/finish` runs `/commit` on yes and
   guides `gh auth login`. (jcardinal)
+- 2026-10-08 — Claude posts the PM comment and writes PR/commit/KB summaries without asking
+  for approval; `clickup_create_comment` removed from permissions.ask. Field changes and
+  pushes still ask. (jcardinal)
+- 2026-10-08 — Added big-read/saved-file behavior, `gh auth login` note, and PR summary Action. (jcardinal)
 
 ## Related
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.980",
+  "version": "1.0.982",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/rules/common/git-workflow.md

@@ -34,7 +34,9 @@ describes. It does not authorize publishing anything else in the session.
 - `/commit` — local commits of only the files this session changed. Never pushes.
 - `/finish` — the KB push to `_main`, the ticket-branch pushes, the PRs, and the ticket writes.
   If this session's files are uncommitted, `/finish` asks once and, on "yes", runs the
-  `/commit` steps itself (same rules as `/commit`).
+  `/commit` steps itself (same rules as `/commit`). Claude writes and posts the PM comment,
+  PR subject/body, commit notes, and KB summary itself — no approval prompt (secret scan
+  still runs). Ticket field changes still need the one approval list; pushes still ask.
 - `/ship`, `/land-and-deploy` — the commits, pushes, and PRs they describe.
 
 Force-pushing is never automatic in any repo, including the knowledge repo.

package/scripts/install.js

@@ -436,7 +436,10 @@ const RETIRED_TOGA_HOOKS = ['kickoff-gate.js'];
 
 // Permission rules the TOGA template once shipped and no longer wants. Only exact TOGA-owned
 // strings go here — a developer's own rules are never removed.
-const RETIRED_TOGA_PERMISSIONS = { ask: ['mcp__clickup__clickup_create_task_comment'] };
+const RETIRED_TOGA_PERMISSIONS = { ask: [
+  'mcp__clickup__clickup_create_task_comment',
+  'mcp__clickup__clickup_create_comment',
+] };
 
 function mergeSettings(claudeDir, sourceDir) {
   const templatePath = path.join(sourceDir, '.claude', 'settings.json');

package/skills/finish/SKILL.md

@@ -9,7 +9,11 @@ Order: **Part 1** KB capture (always) → **Part 2** ticket field check (always,
 a ticket) → **Part 3** "Is this ticket finished?" → push, PRs, PM comment, status.
 
 Keep the main thread lean: the KB write pipeline runs in the `session-capture` subagent, and
-ClickUp reads run in the `ticket-reader` subagent. The main thread distills, asks, and approves.
+ClickUp reads run in the `ticket-reader` subagent. The main thread distills and asks only for real decisions.
+
+Claude writes and posts all summary text itself — PM comment, PR subject and body, commit
+notes, KB capture summary. Never ask the developer to approve that wording. Approvals are only
+for real decisions: ticket field changes (one list), ELEVATED KB docs, and pushes.
 
 ## Step 0 — Rules, helpers, session ticket
 
@@ -31,8 +35,8 @@ Never: force-push, push any other branch, commit source code (that is `/commit`)
 **Has Code Changes** field (`af9eaba8-d3d3-4769-b8bc-28de78b04570` — worker2 owns it), write
 "Pseudocode Review" / "Pseudocode Required", touch any other ticket, or use the old read-only
 `mcp__claude_ai_ClickUP_for_Dev__*` tools. The `start-gate` hook blocks every other ClickUp
-write (other tools, other fields, other tickets). Claude Code asks the developer before every
-ClickUp write — that prompt is expected; it is the approval gate. `git push` may also ask for
+write (other tools, other fields, other tickets). Claude Code asks before `clickup_update_task`
+(field changes) — that prompt is expected. The PM comment posts without a prompt. `git push` may also ask for
 permission — that is expected too.
 
 **Helpers** (both print JSON):
@@ -428,7 +432,7 @@ Exit 0 + `{ok:true}` = clean. Exit 1 + `{ok:false, hits:[...]}` = a hit: show th
 the hit types (it never prints the values), fix the text, and scan again. Exit 2 = the file
 could not be read — fix the path. Never post until it prints `{ok:true}`.
 
-## Step 15 — PM comment (developer approves the text first)
+## Step 15 — PM comment (Claude writes and posts it — no approval)
 
 Draft a short comment for the PM and release notes. Plain words, no code dumps, no secrets,
 no local paths:
@@ -443,15 +447,15 @@ no local paths:
 **Ticket fields changed by Claude:** <from Step 10 — or "None">
 ```
 
-Show it; after the developer approves (edit if asked), write the text to a temp file
+Do not ask the developer to approve it. Write the text to a temp file
 (`toga-comment-<TICKET>.md` in the OS temp dir), run the **Secret scan** on it, delete the
-file, then post:
+file. Stop only on a hit. Then post it, and show the posted text in the Step 17 report:
 
 ```
 mcp__clickup__clickup_create_comment
   entity_type: "task"
   entity_id: "<internalId>"
-  comment_text: "<approved markdown, max 40000 characters>"
+  comment_text: "<markdown, max 40000 characters>"
 ```
 
 ## Step 16 — Set the status
@@ -472,7 +476,7 @@ Short list:
 1. KB: publish status (Step 5).
 2. Ticket fields changed (or "none").
 3. PRs: one url per repo, and which got `re-review`.
-4. PM comment: posted (yes/no).
+4. PM comment: posted (yes/no), with the posted text.
 5. Status: `development finished` (or why not).
 6. Anything manual the developer must still do — as a numbered list.