yadflow 2.4.2 → 2.5.0

package/CHANGELOG.md

@@ -1,9 +1,9 @@
-## [2.4.2](https://github.com/abdelrahmannasr/yadflow/compare/v2.4.1...v2.4.2) (2026-06-14)
+# [2.5.0](https://github.com/abdelrahmannasr/yadflow/compare/v2.4.2...v2.5.0) (2026-06-14)
 
 
-### Bug Fixes
+### Features
 
-* route GitLab CI gate jobs to tag-locked runners via $YAD_RUNNER_TAGS ([a0311c5](https://github.com/abdelrahmannasr/yadflow/commit/a0311c5af647f63968f3f34e8e6e6fa48b7423d8)), closes [#50](https://github.com/abdelrahmannasr/yadflow/issues/50)
+* per-scope roster roles + auto assignee/reviewer on PRs ([5ff066b](https://github.com/abdelrahmannasr/yadflow/commit/5ff066b2a83f63ddf25353ddaf0a088b91a6adb0))
 
 # [2.2.0](https://github.com/abdelrahmannasr/yadflow/compare/v2.1.0...v2.2.0) (2026-06-14)
 

package/cli/doctor.mjs

@@ -8,7 +8,7 @@ import { c, log, ok, info, warn, fail, hand, run, has, exists, readJSON, readJSO
 import { VERSION, PROJECT_FILES, DESIGN_TOOLS, TESTING_TOOLS, LEARNING_TOOLS } from './manifest.mjs';
 import { loadLedger, epicRoot } from './epic-state.mjs';
 import { gitHead } from './setup.mjs';
-import { cliFor } from './platform.mjs';
+import { cliFor, validateLogin } from './platform.mjs';
 
 const MIN_NODE = 18;
 
@@ -70,7 +70,18 @@ export function projectChecks(checks, root) {
       if (cli) {
         if (!has(cli)) check(checks, 'platform-cli', 'project', 'warn', `${cli} not found on PATH [YAD-ENV-002]`, `install ${cli} — the gate degrades to file-only without it`);
         else if (!run(cli, ['auth', 'status']).ok) check(checks, 'platform-cli', 'project', 'warn', `${cli} present but not authenticated [YAD-ENV-002]`, `run \`${cli} auth login\``);
-        else check(checks, 'platform-cli', 'project', 'ok', `${cli} present and authenticated`);
+        else {
+          check(checks, 'platform-cli', 'project', 'ok', `${cli} present and authenticated`);
+          // Re-validate each roster login against the hub (warn-only). Skips when a login is already
+          // flagged unverified by setup; reports any that no longer resolve.
+          const bad = [];
+          for (const e of hub.roster || []) {
+            const v = validateLogin(hub.platform, e.login);
+            if (v.checked && !v.exists) bad.push(e.login);
+          }
+          if (bad.length) check(checks, 'roster', 'project', 'warn', `roster login(s) not found on ${hub.platform}: ${bad.join(', ')}`, 'fix the login or re-run `yad setup` (they cannot satisfy a gate)');
+          else check(checks, 'roster', 'project', 'ok', `roster: ${(hub.roster || []).length} member(s) validated on ${hub.platform}`);
+        }
       }
     }
   }

package/cli/gate.mjs

@@ -13,7 +13,7 @@ import {
   advanceState, markInReview, isEscalated, parseReviewBranch, artifactFromBase,
   artifactPaths, upsertHubPr,
 } from './epic-state.mjs';
-import { readPr, mapApprovers, createPr } from './platform.mjs';
+import { readPr, mapApprovers, createPr, reviewersForScopes, resolveCommitterLogin } from './platform.mjs';
 import { err } from './errors.mjs';
 
 // ---- tiny frontmatter reader (key: value, and `repos: [a, b]`) ----------------------------------
@@ -412,10 +412,15 @@ export async function gateOpen(root, { epic, artifact } = {}) {
   if (!hub?.platform) { warn('no hub platform — marked in_review file-only (no PR opened)'); ok(`${step.id} → in_review`); return; }
 
   const body = fillHubTemplate({ epic, artifact, step, owner: ownerOf(epicDir), domains });
-  const reviewers = (hub.roster || []).filter((r) => r.role !== 'owner').map((r) => r.login);
+  // Assignee = whoever opens the review PR (the committer); reviewers = the hub's reviewers +
+  // domain-owners of the touched repos, minus the committer (the owner/author is recorded, not asked
+  // to review their own artifact). Scope is the hub plus every touched domain.
+  const committer = resolveCommitterLogin(root, hub.roster || []);
+  const reviewers = reviewersForScopes(hub.roster || [], ['hub', ...domains], { excludeLogin: committer });
+  const assignees = committer ? [committer] : [];
   const labels = isEscalated(step) ? domains.map((d) => `domain:${d}`) : [];
   info(`opening review ${hub.platform === 'gitlab' ? 'MR' : 'PR'} on branch ${branch} …`);
-  const r = createPr(hub.platform, { title: `review: ${artifact} (${epic})`, body, base: hub.default_branch || 'main', head: branch, reviewers, labels, cwd: root });
+  const r = createPr(hub.platform, { title: `review: ${artifact} (${epic})`, body, base: hub.default_branch || 'main', head: branch, reviewers, assignees, labels, cwd: root });
   if (!r.ok) { warn(`could not open PR (${r.reason || 'unknown'}); step is in_review file-only`); return; }
 
   const number = Number((r.url.match(/\/(\d+)(?:[/?#]|$)/) || [])[1]) || null;

package/cli/openpr.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { c, log, ok, info, hand, fail, run, exists, readJSON } from './lib.mjs';
 import { PROJECT_FILES } from './manifest.mjs';
-import { detectPlatform, createPr } from './platform.mjs';
+import { detectPlatform, createPr, reviewersForScopes, resolveCommitterLogin } from './platform.mjs';
 import { taskFromBranch } from './commit.mjs';
 
 // Resolve the target code repo: --repo <name> from the registry, else --dir, else cwd.
@@ -57,7 +57,17 @@ export async function runOpenPr(root, opts = {}) {
     task, risk: opts.risk || 'low', contract: !!opts.contractChange, domains: meta?.name,
   });
 
-  const r = createPr(platform, { title, body, base: baseBranch, head: branch, cwd: repoRoot });
+  // Auto-assign from the hub roster, scoped to this repo: assignee = the committer (resolved from
+  // local git identity), reviewers = the repo's reviewers + domain-owners, minus the committer.
+  // Degrades cleanly when there is no roster / the committer is unmapped (gh self-assigns via @me).
+  const hub = readJSON(path.join(root, PROJECT_FILES.hubConfig), { roster: [] });
+  const roster = hub.roster || [];
+  const committer = resolveCommitterLogin(repoRoot, roster);
+  const scope = meta?.name ? [meta.name] : [];
+  const reviewers = reviewersForScopes(roster, scope, { excludeLogin: committer });
+  const assignees = committer ? [committer] : [];
+
+  const r = createPr(platform, { title, body, base: baseBranch, head: branch, reviewers, assignees, cwd: repoRoot });
   if (!r.ok) { fail(`could not open PR/MR — ${r.reason || 'unknown'}`); process.exitCode = 1; return; }
   ok(`opened ${r.url}`);
   if (opts.risk === 'high' || opts.contractChange) hand('high risk / contract surface — run `bash checks/risk-route.sh "<pr body>"` for required reviewers');

package/cli/platform.mjs

@@ -23,18 +23,102 @@ export function platformReady(platform) {
   return !!cli && has(cli);
 }
 
+// ---- roster role model (per-scope map, with legacy back-compat) ---------------------------------
+// A roster entry's roles live in a per-scope map: `roles: { hub: ["owner","reviewer"], <repo>: [...] }`.
+// `rolesForScope` normalizes the three shapes a roster entry can take on disk:
+//   1. new object map     — `entry.roles = { hub: [...], backend: [...] }`
+//   2. flat array variant — `entry.roles = ["owner","reviewer"]` (treated as hub roles)
+//   3. legacy single role — `entry.role = "owner"` (a hub role; pre per-scope schema)
+// The legacy `repos.json` `domain_owner` field is handled separately by resolveLogin's fallback.
+export function rolesForScope(entry, scope) {
+  if (!entry) return [];
+  const r = entry.roles;
+  if (r && typeof r === 'object' && !Array.isArray(r)) return Array.isArray(r[scope]) ? r[scope] : [];
+  if (Array.isArray(r)) return scope === 'hub' ? r : [];
+  if (typeof entry.role === 'string' && entry.role) return scope === 'hub' ? [entry.role] : [];
+  return [];
+}
+
+// True when the entry holds any of `wanted` roles across any of `scopes`.
+export function hasAnyRole(entry, scopes = [], wanted = []) {
+  for (const scope of scopes) {
+    for (const role of rolesForScope(entry, scope)) {
+      if (wanted.includes(role)) return true;
+    }
+  }
+  return false;
+}
+
+// Platform logins to auto-request as reviewers for the given scopes: everyone holding a `reviewer`
+// or `domain-owner` role in any scope, minus `excludeLogin` (you don't review your own PR), deduped.
+export function reviewersForScopes(roster = [], scopes = [], { excludeLogin = null } = {}) {
+  const out = [];
+  for (const entry of roster) {
+    if (!entry.login || entry.login === excludeLogin) continue;
+    if (hasAnyRole(entry, scopes, ['reviewer', 'domain-owner']) && !out.includes(entry.login)) out.push(entry.login);
+  }
+  return out;
+}
+
+// The committer/PR-opener's platform login, resolved from local git identity through the roster.
+// Match on commit email first (the stable key), then fall back to name/login. null when unresolved.
+export function resolveCommitterLogin(cwd, roster = []) {
+  const email = (run('git', ['config', 'user.email'], { cwd }).stdout || '').trim().toLowerCase();
+  const name = (run('git', ['config', 'user.name'], { cwd }).stdout || '').trim();
+  if (email) {
+    const byEmail = roster.find((r) => (r.email || '').toLowerCase() === email);
+    if (byEmail) return byEmail.login || null;
+  }
+  if (name) {
+    const byName = roster.find((r) => r.name === name || r.login === name);
+    if (byName) return byName.login || null;
+  }
+  return null;
+}
+
+// Does this platform login exist on the hub? Warn-only (never throws): `checked:false` when the CLI
+// is absent/unauthenticated so callers can distinguish "not a user" from "couldn't check".
+export function validateLogin(platform, login) {
+  const cli = cliFor(platform);
+  if (!cli || !has(cli) || !login) return { ok: false, exists: false, checked: false };
+  if (platform === 'github') {
+    const r = run('gh', ['api', `users/${login}`]);
+    return { ok: r.ok, exists: r.ok, checked: true };
+  }
+  // gitlab: users?username=<login> returns an array; empty array => no such user.
+  const r = run('glab', ['api', `users?username=${encodeURIComponent(login)}`]);
+  if (!r.ok) return { ok: false, exists: false, checked: true };
+  let exists = false;
+  try { exists = Array.isArray(JSON.parse(r.stdout)) && JSON.parse(r.stdout).length > 0; } catch { exists = false; }
+  return { ok: exists, exists, checked: true };
+}
+
 // ---- login -> yad identity (roster + derived domain-owner) -------------------------------------
-// Returns the records this login's APPROVED review contributes. A roster reviewer who owns a touched
-// repo's domain contributes BOTH a base record and a domain-owner record (bridge.md "Login -> role").
+// Returns the records this login's APPROVED review contributes. Roles are read from the per-scope
+// map: hub roles plus, for each touched domain, that repo's scoped roles (domain-owner carries the
+// `domain` tag). The legacy `repos.json` `domain_owner === name` mapping is kept as a fallback so
+// pre per-scope projects still resolve domain owners.
 export function resolveLogin(login, roster = [], repos = [], touchedDomains = []) {
   const entry = roster.find((r) => r.login === login);
   if (!entry) return [{ name: login, role: 'reviewer', unverified: true }];
-  const records = [{ name: entry.name, role: entry.role }];
-  for (const repo of repos) {
-    if (repo.domain_owner === entry.name && touchedDomains.includes(repo.name)) {
-      records.push({ name: entry.name, role: 'domain-owner', domain: repo.name });
+  const records = [];
+  const push = (rec) => {
+    if (!records.some((x) => x.name === rec.name && x.role === rec.role && x.domain === rec.domain)) records.push(rec);
+  };
+  for (const role of rolesForScope(entry, 'hub')) push({ name: entry.name, role });
+  for (const d of touchedDomains) {
+    for (const role of rolesForScope(entry, d)) {
+      push(role === 'domain-owner' ? { name: entry.name, role, domain: d } : { name: entry.name, role });
     }
+    // Legacy fallback: a repo whose domain_owner is this name confers domain-owner for that domain.
+    const legacy = repos.find((repo) => repo.name === d && repo.domain_owner === entry.name);
+    if (legacy) push({ name: entry.name, role: 'domain-owner', domain: d });
   }
+  // An identity-only entry (no roles map and no legacy `role`) still contributes a base reviewer
+  // record so an approval from a known person is never silently dropped. An entry that DOES declare
+  // roles but none apply to these scopes contributes nothing here (it is scoped elsewhere).
+  const hasNoRoleInfo = !entry.role && !(entry.roles && (Array.isArray(entry.roles) ? entry.roles.length : Object.keys(entry.roles).length));
+  if (!records.length && hasNoRoleInfo) push({ name: entry.name, role: 'reviewer' });
   return records;
 }
 
@@ -134,18 +218,28 @@ export function readPr(platform, n, opts = {}) {
 }
 
 // ---- create a PR/MR -----------------------------------------------------------------------------
-export function createPr(platform, { title, body, base, head, reviewers = [], labels = [], cwd } = {}) {
-  if (!platformReady(platform)) return { ok: false, reason: `${cliFor(platform) || 'platform CLI'} not available` };
+// `assignees` = the committer/PR-opener (always set, so the PR is owned by whoever pushed it);
+// `reviewers` = the scope's reviewers + domain-owners (computed by reviewersForScopes). On GitHub an
+// empty assignee list falls back to `@me` so the opener still self-assigns even without a roster.
+// Pure argv builder for the create command — exported so the reviewer/assignee/label wiring is
+// unit-testable without shelling out. gh always self-assigns (@me) when no assignee resolved.
+export function buildPrArgs(platform, { title, body, base, head, reviewers = [], labels = [], assignees = [] } = {}) {
   if (platform === 'gitlab') {
     const args = ['mr', 'create', '--title', title, '--description', body, '--target-branch', base, '--source-branch', head, '--yes'];
     if (reviewers.length) args.push('--reviewer', reviewers.join(','));
+    if (assignees.length) args.push('--assignee', assignees.join(','));
     if (labels.length) args.push('--label', labels.join(','));
-    const r = run('glab', args, { cwd });
-    return { ok: r.ok, url: r.stdout.split('\n').pop(), reason: r.stderr };
+    return args;
   }
   const args = ['pr', 'create', '--title', title, '--body', body, '--base', base, '--head', head];
   if (reviewers.length) args.push('--reviewer', reviewers.join(','));
+  args.push('--assignee', assignees.length ? assignees.join(',') : '@me');
   if (labels.length) args.push('--label', labels.join(','));
-  const r = run('gh', args, { cwd });
+  return args;
+}
+
+export function createPr(platform, opts = {}) {
+  if (!platformReady(platform)) return { ok: false, reason: `${cliFor(platform) || 'platform CLI'} not available` };
+  const r = run(cliFor(platform), buildPrArgs(platform, opts), { cwd: opts.cwd });
   return { ok: r.ok, url: r.stdout.split('\n').pop(), reason: r.stderr };
 }

package/cli/setup.mjs

@@ -11,6 +11,12 @@ import {
   moduleActions, repoActions, hubActions, authorsActions,
   legacyModuleActions, legacyRepoActions, legacyHubActions,
 } from './plan.mjs';
+import { validateLogin } from './platform.mjs';
+
+// Parse a comma/space separated list into a clean, deduped array of trimmed tokens.
+function parseList(s) {
+  return [...new Set((s || '').split(/[,\s]+/).map((x) => x.trim()).filter(Boolean))];
+}
 
 const ALL_IDES = [...IDE_FOLDER_TARGETS, '.opencode'];
 
@@ -34,7 +40,35 @@ export function insideRoot(root, rpath) {
 // Validate + record one code repo into the registry (the testable half of the connect loop).
 // A path that is not a git repository is rejected and NOTHING is written — a registry entry with
 // syncedHead:null would only surface later as an unexplained "unknown status" in the CI gates.
-export function registerRepo(root, registry, { name, rpath, platform, domain_owner = '', default_branch = 'main', today = null }) {
+// Grant per-repo roles to roster members by writing into each person's `roles[<repo>]` array in
+// hub.json. `grants` maps a role -> the yad names that hold it for this repo. A name that is not in
+// the roster is warned about and skipped (the roster is the source of identity). Idempotent.
+export function addRepoRoles(root, repo, grants = {}) {
+  const hubPath = path.join(root, PROJECT_FILES.hubConfig);
+  const hub = readJSON(hubPath, null);
+  if (!hub || !Array.isArray(hub.roster)) return;
+  const byName = new Map(hub.roster.map((e) => [e.name, e]));
+  let touched = false;
+  for (const [role, names] of Object.entries(grants)) {
+    for (const nm of names) {
+      const entry = byName.get(nm);
+      if (!entry) { warn(`'${nm}' is not in the roster — skipped ${role} for ${repo}`); continue; }
+      // Normalize to the per-scope map, migrating the legacy shapes: a flat array or a single
+      // `role` string both become hub roles so nothing is lost.
+      if (!entry.roles || typeof entry.roles !== 'object' || Array.isArray(entry.roles)) {
+        const hub = Array.isArray(entry.roles) ? entry.roles : (entry.role ? [entry.role] : []);
+        entry.roles = hub.length ? { hub } : {};
+        delete entry.role;
+      }
+      const list = Array.isArray(entry.roles[repo]) ? entry.roles[repo] : [];
+      if (!list.includes(role)) { list.push(role); touched = true; }
+      entry.roles[repo] = list;
+    }
+  }
+  if (touched) writeJSON(hubPath, hub);
+}
+
+export function registerRepo(root, registry, { name, rpath, platform, domain_owner = '', domain_owners = null, default_branch = 'main', today = null }) {
   if (!insideRoot(root, rpath)) {
     warn(`${rpath} resolves outside the project root — skipped`);
     return null;
@@ -49,8 +83,12 @@ export function registerRepo(root, registry, { name, rpath, platform, domain_own
     if (plat) warn(`unknown platform '${platform}' — using ${detected}`);
     plat = detected;
   }
+  // A repo can have multiple domain owners. `domain_owners` is the array of record; `domain_owner`
+  // is kept as the first element so anything still reading the legacy single-owner field works.
+  const owners = (domain_owners && domain_owners.length) ? domain_owners : (domain_owner ? [domain_owner] : []);
   const repo = {
-    name, path: rpath, git_url: (remote.ok && remote.stdout) || null, platform: plat, domain_owner, default_branch,
+    name, path: rpath, git_url: (remote.ok && remote.stdout) || null, platform: plat,
+    domain_owner: owners[0] || '', domain_owners: owners, default_branch,
     connectedAt: today, lastSyncedAt: today,
     syncedHead: head,
     contextPack: `.sdlc/code-context/${name}/pack.md`,
@@ -226,9 +264,20 @@ export async function runSetup(root, opts = {}) {
         const login = await ask('  reviewer platform login (blank to finish)', '');
         if (!login) break;
         const name = await ask('    yad name', login);
-        const role = await ask('    role (owner/reviewer/domain-owner)', 'reviewer');
-        const email = await ask('    commit email (verified-commits gate; blank to skip)', '');
-        roster.push({ login, name, role, ...(email ? { email } : {}) });
+        const email = await ask('    commit email (committer→login lookup + verified-commits gate; blank to skip)', '');
+        // Per-scope roles: capture the hub roles here; per-repo roles are added in step 7 when the
+        // repo is connected. A person can hold several roles (owner reviewer) at once.
+        const hubRoles = parseList(await ask('    hub roles (owner/reviewer, space-separated)', 'reviewer'));
+        const entry = { login, name, ...(email ? { email } : {}), roles: { hub: hubRoles } };
+        // Validate the login exists on the hub — warn-only (fail-open): a miss is flagged unverified
+        // but still saved. `checked:false` (no CLI/auth) skips the check silently.
+        if (platform !== 'none') {
+          const v = validateLogin(platform, login);
+          if (v.checked && !v.exists) { warn(`'${login}' not found on ${platform} — saved as unverified`); entry.unverified = true; }
+          else if (v.checked && v.exists) ok(`verified ${login} on ${platform}`);
+        }
+        if (email && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) warn(`'${email}' does not look like an email address`);
+        roster.push(entry);
       }
     }
     const default_branch = platform === 'none' ? 'main' : await ask('Hub default branch', 'main');
@@ -306,10 +355,15 @@ export async function runSetup(root, opts = {}) {
       if (!insideRoot(root, rpath)) { warn(`${rpath} resolves outside the project root — skipped`); continue; }
       const detected = run('git', ['remote', 'get-url', 'origin'], { cwd: path.resolve(root, rpath) });
       const platform = (await ask('    platform (github/gitlab)', detectPlatform(detected.ok ? detected.stdout : '') || 'github')).toLowerCase();
-      const domain_owner = await ask('    domain owner', '');
+      // A repo can have one or more domain owners; reviewers/owners can also be scoped to it. Names
+      // refer to roster `name`s; each grant is written into that person's per-scope roles map.
+      const domain_owners = parseList(await ask('    domain owner(s) (yad names, space-separated)', ''));
+      const repoReviewers = parseList(await ask('    repo reviewer(s) (yad names, space-separated; blank to skip)', ''));
+      const repoOwners = parseList(await ask('    repo owner(s) (yad names, space-separated; blank to skip)', ''));
       const default_branch = await ask('    default branch', 'main');
-      const repo = registerRepo(root, registry, { name, rpath, platform, domain_owner, default_branch, today: opts.today ?? null });
+      const repo = registerRepo(root, registry, { name, rpath, platform, domain_owners, default_branch, today: opts.today ?? null });
       if (!repo) continue;
+      addRepoRoles(root, name, { 'domain-owner': domain_owners, reviewer: repoReviewers, owner: repoOwners });
       known.add(name);
       ok(`registered ${name}`);
       packRepo(root, repo);

package/docs/index.html

@@ -475,7 +475,7 @@ each code repo/
   <div class="term"><strong><code>approvals.json</code></strong><span class="badge b-file">files</span><br>Who approved which review, with name + role. The gate reads this to decide whether the rule is met.</div>
   <div class="term"><strong><code>repos.json</code></strong><span class="badge b-file">files</span><br>The project-wide registry of connected code repos (path/URL, platform, domain owner, freshness sha).</div>
   <div class="term"><strong><code>hub.json</code></strong><span class="badge b-file">files</span><br>The hub’s platform record (GitHub or GitLab) plus the reviewer roster, used to run front-half reviews on real PRs/MRs.</div>
-  <div class="term"><strong>Roster</strong><span class="badge b-role">roles</span><br>The mapping from each reviewer’s GitHub/GitLab login to their SDLC name + role (owner / reviewer). Domain owners are derived from each repo’s <code>domain_owner</code> in <code>repos.json</code>, not retyped.</div>
+  <div class="term"><strong>Roster</strong><span class="badge b-role">roles</span><br>The mapping from each person’s GitHub/GitLab login + commit email to their SDLC name and a <strong>per-scope roles map</strong> (<code>roles: { hub: […], &lt;repo&gt;: […] }</code>). One person can be owner, reviewer <em>and</em> domain owner at once; one repo can have several people per role. Logins are validated against GitHub/GitLab at setup (warn-only). When a PR/MR is opened, the committer becomes the <strong>assignee</strong> and the scope’s reviewers + domain owners are <strong>auto-requested</strong>.</div>
   <div class="term"><strong>Code-map</strong><span class="badge b-file">files</span><br>A lightweight, AI-readable summary of a connected code repo — its existing endpoints, events, data models and modules — cached under <code>.sdlc/code-context/</code> so the front-half steps don’t contradict code that already exists.</div>
   <div class="term"><strong>Repomix pack</strong><span class="badge b-tool">tools</span><br>A compressed, secret-scanned snapshot of a repo’s code produced by the Repomix tool (<code>npx repomix</code>), cached alongside the code-map so AI can read the codebase.</div>
   <div class="term"><strong>Fresh / stale</strong><span class="badge b-file">files</span><br>A connected repo’s cached picture is <em>fresh</em> if the repo hasn’t moved since it was packed (tracked by HEAD sha) and <em>stale</em> if it has. Refreshing is a deliberate human decision (<code>yad repo refresh</code>) — skills warn about staleness but never silently re-pack.</div>
@@ -718,12 +718,12 @@ each code repo/
     <h4><code>yad-connect-repos</code></h4>
     <div class="row"><span class="lbl lbl-what">What</span> Introduces your code repos to the product hub so the “brain” knows what is already built. It registers each repo in <code>repos.json</code> and caches an AI-readable picture of it (a Repomix pack + a code-map of existing endpoints, events, data models and modules). Also sets up the hub’s own platform record and reviewer roster.</div>
     <div class="row"><span class="lbl lbl-how">How</span> Run it in the product hub, once per repo:</div>
-<pre><code>yad-connect-repos action: connect repo: backend path: ../backend-repo domain_owner: carol
+<pre><code>yad-connect-repos action: connect repo: backend path: ../backend-repo domain_owners: carol,dave
 yad-connect-repos action: list                 # see every repo as fresh / stale
 yad-connect-repos action: refresh repo: backend  # re-pack after the code moved
 yad-connect-repos action: disconnect repo: backend
 yad-connect-repos action: detect-hub           # record the hub's GitHub/GitLab platform
-yad-connect-repos action: roster login: alice-gh name: alice role: owner   # once per reviewer</code></pre>
+yad-connect-repos action: roster login: alice-gh name: alice email: alice@x.com roles: hub=owner,reviewer  # validated vs the hub</code></pre>
     <div class="row"><span class="lbl lbl-when">When</span> During one-time setup, and again any time you add a new code repo. Re-run <code>refresh</code> when a skill warns a repo is stale. <strong>Greenfield with no code yet? Skip it entirely</strong> — the brain proceeds without it.</div>
   </div>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yadflow",
-  "version": "2.4.2",
+  "version": "2.5.0",
   "description": "Yadflow — the gated, team, multi-repo SDLC: author → review → build with a PR-driven review gate and a zero-dependency `yad` CLI (setup, gate, commit, open-pr, repo). A BMAD module + 22 yad-* skills.",
   "type": "module",
   "author": "AbdelRahman Nasr",

package/skills/yad-connect-repos/SKILL.md

@@ -30,10 +30,13 @@ epic's approvals. It only writes the project-wide registry and the per-repo cont
 
 - `action` — `connect` | `refresh` | `list` | `disconnect` | `detect-hub` | `roster` (default `connect`).
 - `repo` — the repo's short name (the key used in stories' `repos:` tag, e.g. `backend`).
-- `login`, `name`, `role` — for `roster` (set the hub's reviewer-roster mapping login → name → role).
+- `login`, `name`, `email`, `roles` — for `roster` (map login → name + commit email + the per-scope
+  `roles` map, e.g. `roles: hub=owner,reviewer backend=domain-owner`). Validate the login against the
+  hub (`gh api users/<login>` / `glab api users?username=`); a miss is flagged `unverified` (warn-only).
 - `path` — local path to the code repo (relative to `{project-root}` or absolute). For local repos.
 - `git_url` — optional remote (SSH or HTTPS; GitHub or GitLab). Used when the repo is not yet on disk.
-- `domain_owner` — the engineer who owns this repo's domain (drives per-repo review routing later).
+- `domain_owners` — the engineer(s) who own this repo's domain (a repo may have several; drives per-repo
+  review routing). Each name is also written into that person's `roles[<repo>]` map in `hub.json`.
 
 ## On Activation
 
@@ -83,7 +86,8 @@ HEAD sha as `syncedHead` (this drives staleness):
       "path": "<path rel. to project-root>",
       "git_url": "<url or null>",
       "platform": "github|gitlab|null",
-      "domain_owner": "<owner or null>",
+      "domain_owners": ["<owner>", "…"],
+      "domain_owner": "<domain_owners[0] — legacy mirror>",
       "default_branch": "<branch>",
       "connectedAt": "<YYYY-MM-DD>",
       "lastSyncedAt": "<YYYY-MM-DD>",
@@ -122,10 +126,13 @@ write only `{project-root}/.sdlc/hub.json` (`config.yaml` `hub.config`) — neve
   repos: `github.com` → `github`, GitLab host → `gitlab`, no remote → `platform: null`. Record
   `git_url`, `default_branch`, `detectedAt`, and `bridge_enabled: true` (preserve an existing roster).
   Auth is the local user's own `gh`/`glab`/git; **store no tokens**. Idempotent — safe to re-run.
-- **`roster`** — set one roster entry mapping a platform `login` → SDLC `name` + `role`
-  (`owner` | `reviewer`). Upsert by `login`. `domain-owner` is **not** set here — it is derived when a
-  roster `name` equals a repo's `domain_owner` in `repos.json` (see `references/hub-config.md`). An
-  unmapped login degrades to a plain `reviewer`, never auto-promoted to owner/domain-owner.
+- **`roster`** — set one roster entry mapping a platform `login` → SDLC `name` + `email` + a per-scope
+  `roles` map (`roles: { hub: ["owner","reviewer"], <repo>: ["domain-owner", …] }`). Upsert by `login`;
+  a person may hold several roles across several scopes, and a repo several people per role. Validate the
+  `login` against the hub (warn-only; flag `unverified` on a miss). `domain-owner` is written into
+  `roles[<repo>]` (and still **derived** as a fallback when a roster `name` equals a repo's
+  `domain_owner`/`domain_owners` in `repos.json` — see `references/hub-config.md`). An unmapped login
+  degrades to a plain `reviewer`, never auto-promoted to owner/domain-owner.
 
 If the hub has no remote (`platform: null`) or the bridge is disabled, the front-half gate runs
 file-only with no error — the bridge is purely additive.

package/skills/yad-connect-repos/references/hub-config.md

@@ -21,27 +21,36 @@ login to an SDLC name + role. It is a single object for the hub itself — the s
   "bridge_enabled": true,                                     // open review PRs/MRs on the hub for front-half reviews
   "detectedAt": "2026-06-08",                                 // last detect-hub run (YYYY-MM-DD)
   "roster": [
-    { "login": "abdelrahmannasr", "name": "alice", "role": "owner" },
-    { "login": "bob-gh",          "name": "bob",   "role": "reviewer" }
+    { "login": "abdelrahmannasr", "name": "alice", "email": "alice@example.com",
+      "roles": { "hub": ["owner", "reviewer"] } },
+    { "login": "carol-gh", "name": "carol", "email": "carol@example.com",
+      "roles": { "hub": ["reviewer"], "backend": ["domain-owner", "owner"], "payments": ["reviewer"] } }
   ]
 }
 ```
 
-## The roster — login → name → role
+## The roster — login → name → per-scope roles
 
-The roster is how a platform identity (a GitHub/GitLab **login**) becomes an SDLC **name + role** in the
-file ledger (`approvals.json` / `comments.json`). Roles are the same three the gate already uses:
+The roster is how a platform identity (a GitHub/GitLab **login**) becomes an SDLC **name + role(s)** in
+the file ledger (`approvals.json` / `comments.json`). Roles are the same three the gate uses:
 `owner | reviewer | domain-owner`.
 
 - **`login`** — the platform username whose PR review / approval is being mapped.
 - **`name`** — the SDLC name written into the ledger (the same names used across `approvals.json`,
   `comments.json`, and `epic.md` `owner`). Keep it stable.
-- **`role`** — the person's default role: `owner` or `reviewer`.
-
-**`domain-owner` is DERIVED, never duplicated here.** A roster entry whose `name` equals a repo's
-`domain_owner` in `repos.json` is treated as that repo's domain-owner **when that repo is a touched
-domain for the step under review**. `repos.json` stays the single source of domain ownership; the roster
-only resolves the login → name link so the derivation can run.
+- **`email`** — the commit email; drives the **committer → login** reverse lookup that auto-assigns PRs.
+- **`roles`** — a **per-scope map**: scope (`hub`, or a connected repo name) → the roles held there. A
+  person can be **owner + reviewer + domain-owner at once** and across scopes; a repo gets **several**
+  people per role by appearing in several entries' maps. Validated against the hub during `yad setup` /
+  `yad doctor`; a login that does not resolve is flagged `unverified` (warn-only, never blocks).
+
+**Back-compat:** readers also accept a flat array `"roles": ["owner","reviewer"]` (treated as `hub`
+roles) and the legacy single `"role": "owner"` (a `hub` role).
+
+**`domain-owner` may also be DERIVED from `repos.json`.** A roster entry whose `name` equals a repo's
+`domain_owner`/`domain_owners` in `repos.json` is treated as that repo's domain-owner **when that repo is
+a touched domain for the step under review** — kept as a fallback so pre per-scope projects still resolve.
+New setups write the grant directly into the person's `roles[<repo>]` map.
 
 - **Unmapped login fallback.** A login absent from the roster maps to `name: <login>`, `role: reviewer`,
   and is flagged `<!-- unverified login: <login> -->` in the review record (mirrors the code-map

package/skills/yad-connect-repos/references/repos-registry.md

@@ -21,7 +21,8 @@ not under any `epics/EP-<slug>/.sdlc/`.
       "path": "demo-repos/backend",              // path to the code repo, rel. to {project-root} (or absolute)
       "git_url": "git@github.com:org/backend.git", // optional remote; SSH or HTTPS; GitHub or GitLab; null if local-only
       "platform": "github",                       // github | gitlab (from the URL host); null when local-only
-      "domain_owner": "carol",                    // engineer who owns this repo's domain (review routing)
+      "domain_owners": ["carol", "dave"],         // engineers who own this repo's domain (review routing); a repo may have several
+      "domain_owner": "carol",                    // legacy single-owner mirror = domain_owners[0] (kept for back-compat readers)
       "default_branch": "main",
       "connectedAt": "2026-06-08",                // first connect (YYYY-MM-DD)
       "lastSyncedAt": "2026-06-08",               // last connect/refresh

package/skills/yad-hub-bridge/references/login-roster.md

@@ -7,19 +7,33 @@ in `../../yad-connect-repos/references/hub-config.md`; this file covers how the
 ## Entry
 
 ```json
-{ "login": "abdelrahmannasr", "name": "alice", "role": "owner" }
+{
+  "login": "abdelrahmannasr",
+  "name": "alice",
+  "email": "alice@example.com",
+  "roles": { "hub": ["owner", "reviewer"], "backend": ["domain-owner"] }
+}
 ```
 
 - `login` — the GitHub/GitLab username whose review/approval is being mapped.
 - `name` — the SDLC name written to `approvals.json` / `comments.json` (the same names as `epic.md`
   `owner` and `repos.json` `domain_owner`). Keep it stable.
-- `role` — the person's default role: `owner` or `reviewer`. **Not** `domain-owner` — that is derived.
+- `email` — the commit email; drives the **committer → login** reverse lookup used to auto-assign PRs.
+- `roles` — a **per-scope map** from a scope (`hub`, or a connected repo name) to the roles held there
+  (`owner` / `reviewer` / `domain-owner`). A person can hold several roles in one scope (owner **and**
+  reviewer **and** domain-owner at once), and several scopes; a repo gets several owners/reviewers/
+  domain-owners by being listed in several people's maps.
+
+**Back-compat (read on all three shapes):** the per-scope object above; a flat array
+`"roles": ["owner","reviewer"]` (treated as `hub` roles); and the legacy single `"role": "owner"`
+(a `hub` role). The legacy `repos.json` `domain_owner` field is still honored (see Resolution step 2).
 
 ## Resolution
 
-1. **login → name + role** from the roster.
-2. **domain-owner is derived:** if the resolved `name` equals a repo's `domain_owner` in `repos.json`,
-   and that repo is a **touched domain** for the step under review, the bridge also emits a
+1. **login → name + roles** from the roster. The `hub` roles map straight to records; each touched
+   domain `R` contributes the roles in `roles[R]` (a `domain-owner` role carries `domain: R`).
+2. **Legacy domain-owner fallback:** if the resolved `name` equals a repo's `domain_owner` in
+   `repos.json`, and that repo is a **touched domain** for the step under review, the bridge also emits a
    `domain-owner` approval scoped to that repo (`domain: <repo>`). One person owning several repos yields
    several `domain-owner` records with different `domain` values — exactly what the gate predicate allows.
 3. **Unmapped login → reviewer (flagged).** A login not in the roster maps to `name: <login>`,
@@ -27,6 +41,19 @@ in `../../yad-connect-repos/references/hub-config.md`; this file covers how the
    reviewer but is **never** auto-promoted to owner/domain-owner, so a stranger can never satisfy the
    owner/domain-owner requirement. The marker prompts a human to add the login to the roster.
 
+## Auto-assignee / auto-reviewer on PR/MR open
+
+When a review PR/MR is opened (hub `yad gate open`, or a code-repo `yad open-pr`):
+
+- **Assignee = the committer/opener** — resolved from local git identity (`user.email`, then
+  `user.name`) through the roster (`email`/`name`/`login`). On GitHub an unresolved committer still
+  self-assigns via `@me`.
+- **Reviewers = `reviewer` + `domain-owner`** for the touched scope(s) (`hub` plus every touched
+  domain for a hub review; the repo itself for a code PR), **minus the committer** — you do not review
+  your own PR. The artifact **owner/author is recorded, not requested.**
+- Logins are validated against the hub during `yad setup` / `yad doctor` (`gh api users/<login>`,
+  `glab api users?username=<login>`); a miss is flagged `unverified` but never blocks (fail-open).
+
 ## Per-repo routing (stories review, and any escalated step)
 
 The stories review needs a `domain-owner` per repo in the **union of every story's `repos`**. On the

package/skills/yad-pr-template/SKILL.md

@@ -70,6 +70,11 @@ required reviewers:
   approval per touched domain — identical to `yad-review-gate`'s escalation. The actual approvals are
   recorded by the engineer review (Step E), via `yad-review-gate`.
 
+When the PR/MR is actually opened with `yad open-pr`, these reviewers are **requested automatically**
+from the repo-scoped roster (everyone with `reviewer`/`domain-owner` for the repo, minus the committer),
+and the **committer is set as the assignee**. `risk-route.sh` remains the advisory printout of who the
+gate will require.
+
 ### Step 4 — Stop (no auto-advance)
 Report what was committed (or the routing result). The template and routing are advisory inputs to the
 human review (Step E); they do not approve or merge. Do not touch the epic's `.sdlc/` state.

package/skills/yad-review-gate/references/gating.md

@@ -63,8 +63,14 @@ on a real PR/MR instead of (or as well as) the skill recording it directly. `act
 tagged `"source": "bridge"`. **The predicate above is unchanged**: it counts owner/reviewer/domain-owner
 approvals regardless of how they were recorded.
 
-- login → role via the roster; `domain-owner` derived when a roster `name` equals a repo's `domain_owner`
-  and that repo is a touched domain; an unmapped login is a plain `reviewer`, never promoted.
+- login → role(s) via the roster's **per-scope map** (`roles: { hub: [...], <repo>: [...] }`): a person
+  can hold owner + reviewer + domain-owner at once, and a repo can list several people per role. The
+  `hub` roles plus each touched domain's `roles[<repo>]` are emitted; `domain-owner` is also **derived**
+  when a roster `name` equals a repo's `domain_owner`/`domain_owners` (legacy fallback) and that repo is a
+  touched domain; an unmapped login is a plain `reviewer`, never promoted.
+- On PR/MR open the assignee is the committer and reviewers are the scope's `reviewer` + `domain-owner`
+  members (minus the committer); the owner/author is recorded, not requested. See
+  `../yad-hub-bridge/references/login-roster.md`.
 - `sync` is idempotent (upsert by `(step, approver, role, domain)`; supersede revoked; key comments on
   comment id) and never touches **manual** approvals.
 - The architecture+contract staleness rule applies to bridge approvals too: a re-lock discards bridge