yadflow 2.14.0 → 2.16.0

package/skills/yad-pr-template/templates/checks/pr-title.sh

@@ -5,22 +5,39 @@
 #     period (config.yaml build.pr_title_style: same_as_commit_subject; one task = one PR, the title is
 #     the squash-merge subject). Keep <type> in sync with cli/manifest.mjs COMMIT_TYPES.
 #   --profile hub — a front-half artifact-review title "review: <artifact> (EP-<slug>)", the shape
-#     `yad gate open` creates (cli/gate.mjs).
+#     `yad gate open` creates (cli/gate.mjs) — BUT only for review/EP-* head branches. Every other
+#     hub PR is a tooling/code change to the hub itself and follows the code convention; pass the
+#     head ref via --head so the gate can tell the two apart (a tooling PR has no EP artifact to
+#     review). With no --head, the hub profile stays strict (requires the review shape).
+#     Branch name is not enough on its own: a non-review head that actually changes front-half
+#     artifacts (epics/**) would otherwise slip past the review workflow with a plain code title.
+#     Pass the PR's changed paths via --changed <file> (one path per line); when they touch epics/**
+#     on a non-review head the gate FAILS — artifact changes must go through a review/EP-* PR.
 # The title is passed as the (single) positional arg; CI injects it from the event payload
 # (GitHub: github.event.pull_request.title; GitLab: $CI_MERGE_REQUEST_TITLE).
 set -euo pipefail
 
 PROFILE=code
+HEADREF=""
+CHANGED=""
 ARGS=()
 while [ $# -gt 0 ]; do
   case "$1" in
     --profile) PROFILE="${2:-code}"; shift 2 ;;
     --profile=*) PROFILE="${1#*=}"; shift ;;
+    --head) HEADREF="${2:-}"; shift 2 ;;
+    --head=*) HEADREF="${1#*=}"; shift ;;
+    --changed) CHANGED="${2:-}"; shift 2 ;;
+    --changed=*) CHANGED="${1#*=}"; shift ;;
     *) ARGS+=("$1"); shift ;;
   esac
 done
 case "$PROFILE" in code|hub) ;; *) echo "FAIL [pr-title]: unknown --profile '$PROFILE' (code|hub)."; exit 1 ;; esac
 
+# True when the PR changes a front-half artifact (anything under epics/**). Reads the --changed list
+# of paths CI computed from the PR diff; with no list (direct caller / test) it reports false.
+artifact_changed() { [ -n "$CHANGED" ] && [ -f "$CHANGED" ] && grep -qE '^epics/' "$CHANGED"; }
+
 TITLE="${ARGS[0]:-}"
 if [ -z "$TITLE" ]; then
   echo "FAIL [pr-title]: empty title — pass the PR/MR title as the argument."
@@ -29,23 +46,43 @@ fi
 
 TYPES='feat|fix|docs|refactor|test|perf|build|ci|chore|revert'
 
-if [ "$PROFILE" = hub ]; then
-  # review: <artifact> (EP-<slug>)
-  if printf '%s' "$TITLE" | grep -qE '^review: .+ \(EP-[a-z0-9-]+\)$'; then
-    echo "PASS [pr-title]: '${TITLE}' (profile: hub)"
-    exit 0
+# Conventional-Commits subject (optional scope + breaking `!`), no trailing period. Used by the code
+# profile and by hub tooling PRs (any head branch that is not review/EP-*).
+check_code_title() {
+  if ! printf '%s' "$TITLE" | grep -qE "^(${TYPES})(\([a-z0-9._-]+\))?!?: .+"; then
+    echo "FAIL [pr-title]: '${TITLE}' is not '<type>(<scope>)?!?: <description>' (type one of: ${TYPES//|/, })."
+    exit 1
   fi
-  echo "FAIL [pr-title]: '${TITLE}' is not a hub review title 'review: <artifact> (EP-<slug>)'."
-  exit 1
-fi
+  if printf '%s' "$TITLE" | grep -qE '\.$'; then
+    echo "FAIL [pr-title]: '${TITLE}' must not end with a period."
+    exit 1
+  fi
+  echo "PASS [pr-title]: '${TITLE}' (profile: ${PROFILE}, tooling/code)"
+  exit 0
+}
 
-# code profile — Conventional-Commits subject (optional scope + breaking `!`), no trailing period.
-if ! printf '%s' "$TITLE" | grep -qE "^(${TYPES})(\([a-z0-9._-]+\))?!?: .+"; then
-  echo "FAIL [pr-title]: '${TITLE}' is not '<type>(<scope>)?!?: <description>' (type one of: ${TYPES//|/, })."
-  exit 1
-fi
-if printf '%s' "$TITLE" | grep -qE '\.$'; then
-  echo "FAIL [pr-title]: '${TITLE}' must not end with a period."
-  exit 1
+if [ "$PROFILE" = hub ]; then
+  # review/EP-* head branch (or unknown head ref) => front-half artifact-review PR: 'review: <artifact> (EP-<slug>)'.
+  case "$HEADREF" in
+    review/EP-*|"")
+      if printf '%s' "$TITLE" | grep -qE '^review: .+ \(EP-[a-z0-9-]+\)$'; then
+        echo "PASS [pr-title]: '${TITLE}' (profile: hub, artifact-review)"
+        exit 0
+      fi
+      echo "FAIL [pr-title]: '${TITLE}' is not a hub review title 'review: <artifact> (EP-<slug>)'."
+      exit 1
+      ;;
+    *)
+      # Any other hub PR is a tooling/code change to the hub itself — UNLESS it changes front-half
+      # artifacts (epics/**), which must go through a review/EP-* PR. Without this guard a non-review
+      # head could carry an artifact change past the front-half review with only a code title.
+      if artifact_changed; then
+        echo "FAIL [pr-title]: head '${HEADREF}' changes front-half artifacts (epics/**) but is not a review/EP-* branch — artifact changes must go through a review PR."
+        exit 1
+      fi
+      # tooling only — fall through to the code convention.
+      ;;
+  esac
 fi
-echo "PASS [pr-title]: '${TITLE}' (profile: code)"
+
+check_code_title

package/skills/yad-review-gate/SKILL.md

@@ -165,21 +165,23 @@ If the predicate **passes**:
   now `ready-for-build`, with `test-cases` running in parallel).
 
 ### PR-driven automation (the `yad gate` CLI)
-When the hub has a platform, the mechanical `open`/`sync`/`advance` is performed deterministically by the
-**`yad gate` CLI** (`yad gate open|sync|comments|status`), which writes the same `.sdlc/` + `reviews/`
-records this skill describes. The skill's job is then the human half: presenting the artifact, helping the
-owner address comments, and narrating the gate. The CLI is the single implementation of the gh/glab
-mechanics — do not hand-run gh/glab recipes when it is installed.
+When the hub has a platform, **CI is the sole writer of the ledger**. `yad gate open` opens the review
+PR only; CI (`yad gate ci`) writes the `.sdlc/` + `reviews/` records this skill describes. The skill's
+job is the human half: presenting the artifact, helping the owner address comments, and narrating the
+gate. Local `yad gate sync` is advisory in bridge mode (reads the platform, prints status, writes
+nothing); a human must never commit gate-state files (the `ledger-guard` check rejects it).
 
 Under that CLI the gate **advances on merge**: a review PR/MR whose reviewer rule is satisfied, whose
 comment threads are **all resolved**, and which has been **merged** auto-marks the step `done` and
 unblocks the next step. (Until those three hold, the step stays `in_review`.)
 
-`sync` can also be **event-driven**: when the hub is wired with the gate-sync CI (`yad-hub-bridge`
-`wire` action), every approval / change request / dismissal / merge on the review PR/MR triggers
-`yad gate ci` on the hub, which runs the same sync and commits the ledger updates directly to the
-hub's default branch (pull to see them locally). The predicate, the human merge, and manual
-`yad gate sync` are all unchanged — CI never approves and never merges.
+The flow is **merge-driven** (wired by `yad-hub-bridge` `wire`): during review CI writes nothing — the
+platform PR/MR is the source of truth (native approvals + threads), and CI never touches the review
+branch (so an in-flight approval is never dismissed and required checks never strand). On the human
+**merge** CI re-reads approvals, advances the step, and flips the artifact `status:` on the **default
+branch**. After a merge, `git checkout <default> && git pull` to see it. The predicate and the human
+merge are unchanged — CI never approves and never merges. File-only mode (no platform) keeps the local
+write path.
 
 ### Hard rules (build plan §1, §5)
 - **The merge click is the human approval act.** A front step advances only when a human merges the