yadflow 2.4.2 → 2.6.0

package/skills/yad-checks/templates/gitlab/yad-hub-checks.gitlab-ci.yml

@@ -0,0 +1,39 @@
+# yad-managed-include: yad-checks
+# Pattern gates for the PRODUCT HUB, as an INCLUDABLE fragment. Pulled into the hub's root
+# .gitlab-ci.yml via:
+#   include:
+#     - local: '.gitlab/ci/yad-hub-checks.yml'
+# Every MR (including the front-half review/EP-* MRs) must follow the hub conventions — a
+# Conventional-Commits commit subject, a `review: <artifact> (EP-<slug>)` MR title, and an MR body
+# that uses the hub artifact-review template. They run with `--profile hub`.
+# Job names are yad-hub-prefixed so they coexist with any code-repo fragment in one pipeline; jobs use
+# `needs: []` and no `stage:` so a foreign `stages:` list can neither break nor reorder them.
+default:
+  image: node:20
+  tags: [$YAD_RUNNER_TAGS]
+
+.yad_hub_mr_only:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+
+variables:
+  GIT_DEPTH: "0"   # full history so the commit gate can diff against the target branch
+
+yad-hub-commit-message:
+  extends: .yad_hub_mr_only
+  needs: []
+  script:
+    - bash checks/commit-message.sh --profile hub "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
+
+yad-hub-pr-title:
+  extends: .yad_hub_mr_only
+  needs: []
+  script:
+    - bash checks/pr-title.sh --profile hub "$CI_MERGE_REQUEST_TITLE"
+
+yad-hub-pr-template:
+  extends: .yad_hub_mr_only
+  needs: []
+  script:
+    - body="$(mktemp)"; printf '%s' "$CI_MERGE_REQUEST_DESCRIPTION" > "$body"
+    - bash checks/pr-template.sh --profile hub "$body"

package/skills/yad-commit/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: yad-commit
+description: 'Build-half helper of the gated SDLC. Commit ONE staged atomic change by the conventions — a Conventional-Commits subject, the fixed trailer block (Task → Contract-Change → Co-Authored-By), and an atomic-file guard (≤3 files). The human git author OWNS the commit; an assisting AI is recorded only as a Co-Authored-By footer, chosen per-commit with --ai (claude|copilot|cursor|coderabbit|none — default none, human-only). Drives the zero-dependency `yad commit` CLI; never auto-advances. Use when the user says "commit this", "commit by convention", or "make an atomic commit".'
+---
+
+# SDLC — Commit by Convention (build-half helper)
+
+**Goal:** Turn ONE staged atomic change into a single commit that satisfies the project conventions
+(`CONTRIBUTING.md` / `config.yaml` `build`): a Conventional-Commits subject, the fixed trailer order
+`Task → Contract-Change → Co-Authored-By`, and the atomic-file guard. This is the standalone commit
+step — the same engine `yad-implement` and `yad-ship` use. It **never auto-advances**; it just commits.
+
+## Conventions
+
+- Run **inside the repo holding the staged change** — a code repo under
+  `{project-root}/demo-repos/<repo>/`, or the product hub itself. Use absolute paths.
+- **Stage first.** Only the staged (`git add`) atomic change is committed. The guard refuses more than
+  `ATOMIC_FILE_LIMIT` (3) staged files unless `--force` — split the change instead.
+- **Subject** — `<type>: <lowercase imperative description, no trailing period>`; types are
+  `feat|fix|docs|refactor|test|perf|build|ci|chore|revert`; proper nouns/acronyms keep their case.
+- **Task trailer** — required on a code repo (anchors the `spec-link` + `commit-message` gates). Given
+  with `--task`, else derived from the branch (`feat/<story>-<task>-…`). Hub commits are not
+  task-scoped, so the trailer is optional there.
+- **Contract-Change trailer** — `--contract-change` only when the diff touches the locked contract
+  surface; it routes the change back to the architecture gate.
+- **AI co-author footer** — `--ai <id>` records the assisting tool as a `Co-Authored-By` trailer. The
+  human is always the author; `--ai none` (the default) is an explicit human-only commit.
+
+## Inputs
+
+- `type`    — Conventional-Commits type (required).
+- `message` — the subject text (required), `-m "<subject>"`.
+- `ai`      — co-author footer: `claude|copilot|cursor|coderabbit|none` (default `none`).
+- `task`    — Task trailer (optional; derived from the branch when omitted).
+- `contractChange` — flag; mark the contract surface touched.
+
+## On Activation
+
+### Step 1 — Confirm the atomic stage
+Confirm the change is staged and stays within the file boundary (≤3 files where possible). If more is
+staged, split it into separate commits rather than passing `--force`.
+
+### Step 2 — Commit by convention
+Run the CLI from the repo root:
+```
+yad commit --type <type> -m "<subject>" [--ai <id>] [--task <id>] [--contract-change] [--dry-run]
+```
+Use `--dry-run` first to preview the exact message (subject + trailer block) without committing. The
+CLI validates the type, rejects a trailing period, and emits the trailers in the fixed order.
+
+### Step 3 — Stop (no auto-advance)
+Report what was committed (files + Task). If `--contract-change` was set, note that it routes back to
+the architecture gate. To also open the PR/MR in the same step, use `yad-ship`.
+
+## Hard rules
+
+- **One staged atomic change = one commit.** Never bundle; never exceed the file boundary silently.
+- **The human author owns the commit.** The AI is only a `Co-Authored-By` footer, chosen per-commit.
+- **Trailer order is fixed:** `Task → Contract-Change → Co-Authored-By`.
+- **Never widen the contract here.** A contract touch is flagged (`--contract-change`), not hidden.
+
+## Reference
+- Branch/commit conventions + the file-boundary rule: `../yad-implement/references/implement-conventions.md`.
+- The full convention text: `CONTRIBUTING.md`; the config: `skills/sdlc/config.yaml` `build`.
+- The gate that enforces the subject pattern: `../yad-checks/references/check-gates.md` (`commit-message`).
+- Open the PR/MR after committing: `../yad-open-pr/SKILL.md`; both at once: `../yad-ship/SKILL.md`.

package/skills/yad-connect-repos/SKILL.md

@@ -30,10 +30,13 @@ epic's approvals. It only writes the project-wide registry and the per-repo cont
 
 - `action` — `connect` | `refresh` | `list` | `disconnect` | `detect-hub` | `roster` (default `connect`).
 - `repo` — the repo's short name (the key used in stories' `repos:` tag, e.g. `backend`).
-- `login`, `name`, `role` — for `roster` (set the hub's reviewer-roster mapping login → name → role).
+- `login`, `name`, `email`, `roles` — for `roster` (map login → name + commit email + the per-scope
+  `roles` map, e.g. `roles: hub=owner,reviewer backend=domain-owner`). Validate the login against the
+  hub (`gh api users/<login>` / `glab api users?username=`); a miss is flagged `unverified` (warn-only).
 - `path` — local path to the code repo (relative to `{project-root}` or absolute). For local repos.
 - `git_url` — optional remote (SSH or HTTPS; GitHub or GitLab). Used when the repo is not yet on disk.
-- `domain_owner` — the engineer who owns this repo's domain (drives per-repo review routing later).
+- `domain_owners` — the engineer(s) who own this repo's domain (a repo may have several; drives per-repo
+  review routing). Each name is also written into that person's `roles[<repo>]` map in `hub.json`.
 
 ## On Activation
 
@@ -83,7 +86,8 @@ HEAD sha as `syncedHead` (this drives staleness):
       "path": "<path rel. to project-root>",
       "git_url": "<url or null>",
       "platform": "github|gitlab|null",
-      "domain_owner": "<owner or null>",
+      "domain_owners": ["<owner>", "…"],
+      "domain_owner": "<domain_owners[0] — legacy mirror>",
       "default_branch": "<branch>",
       "connectedAt": "<YYYY-MM-DD>",
       "lastSyncedAt": "<YYYY-MM-DD>",
@@ -122,10 +126,13 @@ write only `{project-root}/.sdlc/hub.json` (`config.yaml` `hub.config`) — neve
   repos: `github.com` → `github`, GitLab host → `gitlab`, no remote → `platform: null`. Record
   `git_url`, `default_branch`, `detectedAt`, and `bridge_enabled: true` (preserve an existing roster).
   Auth is the local user's own `gh`/`glab`/git; **store no tokens**. Idempotent — safe to re-run.
-- **`roster`** — set one roster entry mapping a platform `login` → SDLC `name` + `role`
-  (`owner` | `reviewer`). Upsert by `login`. `domain-owner` is **not** set here — it is derived when a
-  roster `name` equals a repo's `domain_owner` in `repos.json` (see `references/hub-config.md`). An
-  unmapped login degrades to a plain `reviewer`, never auto-promoted to owner/domain-owner.
+- **`roster`** — set one roster entry mapping a platform `login` → SDLC `name` + `email` + a per-scope
+  `roles` map (`roles: { hub: ["owner","reviewer"], <repo>: ["domain-owner", …] }`). Upsert by `login`;
+  a person may hold several roles across several scopes, and a repo several people per role. Validate the
+  `login` against the hub (warn-only; flag `unverified` on a miss). `domain-owner` is written into
+  `roles[<repo>]` (and still **derived** as a fallback when a roster `name` equals a repo's
+  `domain_owner`/`domain_owners` in `repos.json` — see `references/hub-config.md`). An unmapped login
+  degrades to a plain `reviewer`, never auto-promoted to owner/domain-owner.
 
 If the hub has no remote (`platform: null`) or the bridge is disabled, the front-half gate runs
 file-only with no error — the bridge is purely additive.

package/skills/yad-connect-repos/references/hub-config.md

@@ -21,27 +21,36 @@ login to an SDLC name + role. It is a single object for the hub itself — the s
   "bridge_enabled": true,                                     // open review PRs/MRs on the hub for front-half reviews
   "detectedAt": "2026-06-08",                                 // last detect-hub run (YYYY-MM-DD)
   "roster": [
-    { "login": "abdelrahmannasr", "name": "alice", "role": "owner" },
-    { "login": "bob-gh",          "name": "bob",   "role": "reviewer" }
+    { "login": "abdelrahmannasr", "name": "alice", "email": "alice@example.com",
+      "roles": { "hub": ["owner", "reviewer"] } },
+    { "login": "carol-gh", "name": "carol", "email": "carol@example.com",
+      "roles": { "hub": ["reviewer"], "backend": ["domain-owner", "owner"], "payments": ["reviewer"] } }
   ]
 }
 ```
 
-## The roster — login → name → role
+## The roster — login → name → per-scope roles
 
-The roster is how a platform identity (a GitHub/GitLab **login**) becomes an SDLC **name + role** in the
-file ledger (`approvals.json` / `comments.json`). Roles are the same three the gate already uses:
+The roster is how a platform identity (a GitHub/GitLab **login**) becomes an SDLC **name + role(s)** in
+the file ledger (`approvals.json` / `comments.json`). Roles are the same three the gate uses:
 `owner | reviewer | domain-owner`.
 
 - **`login`** — the platform username whose PR review / approval is being mapped.
 - **`name`** — the SDLC name written into the ledger (the same names used across `approvals.json`,
   `comments.json`, and `epic.md` `owner`). Keep it stable.
-- **`role`** — the person's default role: `owner` or `reviewer`.
-
-**`domain-owner` is DERIVED, never duplicated here.** A roster entry whose `name` equals a repo's
-`domain_owner` in `repos.json` is treated as that repo's domain-owner **when that repo is a touched
-domain for the step under review**. `repos.json` stays the single source of domain ownership; the roster
-only resolves the login → name link so the derivation can run.
+- **`email`** — the commit email; drives the **committer → login** reverse lookup that auto-assigns PRs.
+- **`roles`** — a **per-scope map**: scope (`hub`, or a connected repo name) → the roles held there. A
+  person can be **owner + reviewer + domain-owner at once** and across scopes; a repo gets **several**
+  people per role by appearing in several entries' maps. Validated against the hub during `yad setup` /
+  `yad doctor`; a login that does not resolve is flagged `unverified` (warn-only, never blocks).
+
+**Back-compat:** readers also accept a flat array `"roles": ["owner","reviewer"]` (treated as `hub`
+roles) and the legacy single `"role": "owner"` (a `hub` role).
+
+**`domain-owner` may also be DERIVED from `repos.json`.** A roster entry whose `name` equals a repo's
+`domain_owner`/`domain_owners` in `repos.json` is treated as that repo's domain-owner **when that repo is
+a touched domain for the step under review** — kept as a fallback so pre per-scope projects still resolve.
+New setups write the grant directly into the person's `roles[<repo>]` map.
 
 - **Unmapped login fallback.** A login absent from the roster maps to `name: <login>`, `role: reviewer`,
   and is flagged `<!-- unverified login: <login> -->` in the review record (mirrors the code-map

package/skills/yad-connect-repos/references/repos-registry.md

@@ -21,7 +21,8 @@ not under any `epics/EP-<slug>/.sdlc/`.
       "path": "demo-repos/backend",              // path to the code repo, rel. to {project-root} (or absolute)
       "git_url": "git@github.com:org/backend.git", // optional remote; SSH or HTTPS; GitHub or GitLab; null if local-only
       "platform": "github",                       // github | gitlab (from the URL host); null when local-only
-      "domain_owner": "carol",                    // engineer who owns this repo's domain (review routing)
+      "domain_owners": ["carol", "dave"],         // engineers who own this repo's domain (review routing); a repo may have several
+      "domain_owner": "carol",                    // legacy single-owner mirror = domain_owners[0] (kept for back-compat readers)
       "default_branch": "main",
       "connectedAt": "2026-06-08",                // first connect (YYYY-MM-DD)
       "lastSyncedAt": "2026-06-08",               // last connect/refresh

package/skills/yad-engineer-review/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: yad-engineer-review
+description: 'Build-half Step E of the gated SDLC — AI review, engineer review, then merge. Wire an advisory AI first-pass (CodeRabbit) on the PR/MR; record the human engineer review with the same human_approve discipline as the front gates (owner + 1 reviewer, escalating to domain owners on high risk / contract / auth / payments — the Step D routing); and on merge, record the ship in the epic build-log and update the story state so the epic → story → task → PR chain is traceable. Never auto-advances — the human owns the merge. Use when the user says "record the engineer review", "merge this task", or "wire the AI review". (To commit + open the PR/MR, use yad-ship.)'
+---
+
+# SDLC — Engineer Review & Merge (build-half Step E)
+
+**Goal:** Take a task PR/MR that has passed the **check gates** (Step C) through two sets of eyes and
+out to production: an **AI first-pass** (advisory) and a **human engineer review** (the authority),
+then **ship** — merge, record the ship, and update the story state. This is the last build-half step
+(build plan §E). It is a **human gate**, the same `human_approve` discipline as the front states:
+**nothing auto-advances**; the engineer owns the merge.
+
+## Conventions
+
+- `{project-root}` resolves from the project working directory — the **product** repo (the source of
+  truth: it holds the story and the build ledger).
+- Code repos are separate git repos under `{project-root}/demo-repos/<repo>/`.
+- The build ledger is `{project-root}/epics/<epic>/.sdlc/build-log.json` (append-only).
+- The engineer-review rule reuses `yad-review-gate`: base = at least one `owner` AND one distinct
+  `reviewer`; **escalated** (the PR's Impact & Risk is `high`, or it touches contract/auth/payments) =
+  base PLUS one `domain-owner` per touched domain — the same routing `yad-pr-template`'s
+  `risk-route.sh` prints.
+- AI review wiring: `templates/.coderabbit.yaml` → `<repo>/.coderabbit.yaml`.
+
+## Inputs
+
+- `epic` / `story` / `task` / `repo` — the PR under review (the task branch `feat/<story>-<task>-…`).
+- `action` — `ai-review` | `approve` | `ship` (default `ai-review`).
+- For `approve`: the reviewer `name` and `role` (`owner` | `reviewer` | `domain-owner`), and for a
+  domain owner the `domain`.
+
+## On Activation
+
+### Step 1 — `ai-review` (advisory first pass)
+Ensure the AI reviewer is wired: copy `templates/.coderabbit.yaml` to `<repo>/.coderabbit.yaml` (commit
+on the default branch if missing). CodeRabbit reviews each PR automatically and posts comments — it is
+a **second set of eyes, never the authority**: it cannot approve or merge. Where CodeRabbit can't run
+(no remote), run an equivalent AI first-pass by hand and capture its notes. Record that the AI review
+ran; surface its findings to the engineer. Do **not** treat AI approval as a gate.
+
+### Step 2 — `approve` (the engineer review — the human gate)
+A human engineer reads the diff **against the spec** (`specs/<story>/`) and the acceptance criteria,
+and records an approval. Determine the rule from the PR's Impact & Risk block (run
+`../yad-pr-template/templates/checks/risk-route.sh` on the PR body): base, or escalated to a
+domain-owner per touched domain. Record each approval; re-evaluate whether the rule is satisfied.
+Recording an approval does **not** ship — shipping is a separate, explicit step. Front-half discipline:
+the gate talks only through files; refuse to treat AI review as a human approval.
+
+### Step 3 — `ship` (merge + record + update state)
+Ship **iff ALL hold**: the check gates pass (Step C), the AI review has run (advisory), and the
+engineer-review rule is satisfied (Step 2). Then:
+- **Merge** the task branch into the repo's default branch (the human performs/authorises the merge).
+- **Record the ship** — append to `epics/<epic>/.sdlc/build-log.json`:
+  ```json
+  { "story": "<story>", "task": "<task>", "repo": "<repo>", "branch": "feat/<story>-<task>-…",
+    "pr": "<url|#>", "mergeCommit": "<sha>", "gates": ["spec-link","contract-check","build-test-lint"],
+    "ai_review": "coderabbit (advisory)", "engineer_review": [{"approver":"<name>","role":"<role>","domain":"<opt>"}],
+    "risk": "<low|medium|high>", "shippedAt": "<YYYY-MM-DD>" }
+  ```
+- **Update the story state** — when **every** task in `specs/<story>/tasks.md` has a ship record, set
+  the story frontmatter `status: shipped`; otherwise `status: in-build`. The chain
+  **epic → story → task → PR → mergeCommit** is now traceable end to end.
+- **Finalize the trust verdict (Phase 4).** If this story has a `build-state/<story>.json` (it ran
+  through `yad-run`), the engineer **confirms or overrides** the provisional trust verdict that the
+  orchestrator derived for this run, and the final verdict is written to
+  `epics/<epic>/.sdlc/trust-log.json`. The human has the last word on the trust signal: a diff merged
+  as authored is `approved-unchanged`; one the engineer edited before merge is `approved-with-edits`;
+  a rejected one is `rejected`. This is the evidence that later earns a step its `machine_advance`
+  (it never weakens the merge gate — the engineer still owns the merge).
+
+### Step 4 — Stop
+Report what shipped and the story's state. Do not advance anything else; the front-half `state.json`
+stays as it was (`ready-for-build`). The build half is recorded in `build-log.json` + the story status.
+
+## Hard rules (build plan §E, Cross-cutting)
+
+- **AI review is advisory, never the authority.** Only a human engineer approval counts toward the gate.
+- **High risk routes to domain owners** — the same escalation as `yad-review-gate` / `risk-route.sh`.
+- **Ship only after gates + engineer review.** No gate skipped; the human owns the merge.
+- **Nothing auto-advances.** Step E records human decisions in files; it never machine-advances.
+
+## Reference
+- The build ledger + story-state rules: `references/ship-and-record.md`.
+- The escalation reused: `../yad-review-gate/SKILL.md`; the routing helper: `../yad-pr-template/`.
+- The gates that must pass first: `../yad-checks/references/check-gates.md`.

package/skills/{yad-ship → yad-engineer-review}/references/ship-and-record.md

@@ -1,6 +1,6 @@
 # Ship — the build ledger and the story state
 
-Step E (`yad-ship`) closes the build half: AI review (advisory) → engineer review (the human gate) →
+Step E (`yad-engineer-review`) closes the build half: AI review (advisory) → engineer review (the human gate) →
 ship. Shipping records the merge and updates the story state so the whole chain is traceable.
 
 ## Two sets of eyes
@@ -64,4 +64,4 @@ trailer → story → epic).
 2. The **AI review** has run (advisory; findings surfaced to the engineer).
 3. The **engineer review** rule is satisfied (base or escalated per the Impact & Risk block).
 
-Only then does the human merge and `yad-ship` record it. Nothing auto-advances.
+Only then does the human merge and `yad-engineer-review` record it. Nothing auto-advances.

package/skills/{yad-ship → yad-engineer-review}/templates/.coderabbit.yaml

@@ -1,6 +1,6 @@
 # CodeRabbit — AI first-pass review (Phase 3 build plan §E).
 # Advisory only: a second set of eyes that COMMENTS on every PR. It never approves or merges — the
-# human engineer review (yad-review-gate discipline) owns that decision. See skills/yad-ship.
+# human engineer review (yad-review-gate discipline) owns that decision. See skills/yad-engineer-review.
 language: en
 reviews:
   request_changes_workflow: false   # never block the merge — the engineer review is the gate

package/skills/yad-epic/references/state-schema.md

@@ -216,7 +216,7 @@ base** that decides when a step is safe to automate (build plan Step A). One ent
 |------|---------|-------------------------------|
 | `spec` | `human_edited_spec` | the human who accepts `specs/<story>/` (`yad-spec` Step 8) |
 | `tasks` | `task_rescoped` | first consume by `yad-implement` (Step 8) |
-| `implement` | `human_edited_diff`, `scope_overrun`, `contract_touch` | engineer review at `yad-ship` |
+| `implement` | `human_edited_diff`, `scope_overrun`, `contract_touch` | engineer review at `yad-engineer-review` |
 | `checks` | `checks` (`pass`\|`fail`) | the gate run itself (objective) |
 
 **Deriving the provisional verdict** (build plan Step A; extended for `spec`/`tasks` in Phase 4b — the

package/skills/yad-hub-bridge/references/login-roster.md

@@ -7,19 +7,33 @@ in `../../yad-connect-repos/references/hub-config.md`; this file covers how the
 ## Entry
 
 ```json
-{ "login": "abdelrahmannasr", "name": "alice", "role": "owner" }
+{
+  "login": "abdelrahmannasr",
+  "name": "alice",
+  "email": "alice@example.com",
+  "roles": { "hub": ["owner", "reviewer"], "backend": ["domain-owner"] }
+}
 ```
 
 - `login` — the GitHub/GitLab username whose review/approval is being mapped.
 - `name` — the SDLC name written to `approvals.json` / `comments.json` (the same names as `epic.md`
   `owner` and `repos.json` `domain_owner`). Keep it stable.
-- `role` — the person's default role: `owner` or `reviewer`. **Not** `domain-owner` — that is derived.
+- `email` — the commit email; drives the **committer → login** reverse lookup used to auto-assign PRs.
+- `roles` — a **per-scope map** from a scope (`hub`, or a connected repo name) to the roles held there
+  (`owner` / `reviewer` / `domain-owner`). A person can hold several roles in one scope (owner **and**
+  reviewer **and** domain-owner at once), and several scopes; a repo gets several owners/reviewers/
+  domain-owners by being listed in several people's maps.
+
+**Back-compat (read on all three shapes):** the per-scope object above; a flat array
+`"roles": ["owner","reviewer"]` (treated as `hub` roles); and the legacy single `"role": "owner"`
+(a `hub` role). The legacy `repos.json` `domain_owner` field is still honored (see Resolution step 2).
 
 ## Resolution
 
-1. **login → name + role** from the roster.
-2. **domain-owner is derived:** if the resolved `name` equals a repo's `domain_owner` in `repos.json`,
-   and that repo is a **touched domain** for the step under review, the bridge also emits a
+1. **login → name + roles** from the roster. The `hub` roles map straight to records; each touched
+   domain `R` contributes the roles in `roles[R]` (a `domain-owner` role carries `domain: R`).
+2. **Legacy domain-owner fallback:** if the resolved `name` equals a repo's `domain_owner` in
+   `repos.json`, and that repo is a **touched domain** for the step under review, the bridge also emits a
    `domain-owner` approval scoped to that repo (`domain: <repo>`). One person owning several repos yields
    several `domain-owner` records with different `domain` values — exactly what the gate predicate allows.
 3. **Unmapped login → reviewer (flagged).** A login not in the roster maps to `name: <login>`,
@@ -27,6 +41,19 @@ in `../../yad-connect-repos/references/hub-config.md`; this file covers how the
    reviewer but is **never** auto-promoted to owner/domain-owner, so a stranger can never satisfy the
    owner/domain-owner requirement. The marker prompts a human to add the login to the roster.
 
+## Auto-assignee / auto-reviewer on PR/MR open
+
+When a review PR/MR is opened (hub `yad gate open`, or a code-repo `yad open-pr`):
+
+- **Assignee = the committer/opener** — resolved from local git identity (`user.email`, then
+  `user.name`) through the roster (`email`/`name`/`login`). On GitHub an unresolved committer still
+  self-assigns via `@me`.
+- **Reviewers = `reviewer` + `domain-owner`** for the touched scope(s) (`hub` plus every touched
+  domain for a hub review; the repo itself for a code PR), **minus the committer** — you do not review
+  your own PR. The artifact **owner/author is recorded, not requested.**
+- Logins are validated against the hub during `yad setup` / `yad doctor` (`gh api users/<login>`,
+  `glab api users?username=<login>`); a miss is flagged `unverified` but never blocks (fail-open).
+
 ## Per-repo routing (stories review, and any escalated step)
 
 The stories review needs a `domain-owner` per repo in the **union of every story's `repos`**. On the

package/skills/yad-implement/SKILL.md

@@ -124,7 +124,7 @@ finalize a `tasks` trust entry, anchored to what the human/dev actually did with
 Append the entry to `epics/<epic>/.sdlc/trust-log.json` (schema:
 `../yad-epic/references/state-schema.md`). `tasks` stays `human_approve` until its slice clears
 the threshold — this only *gathers* evidence. (The `implement` step's own verdict is finalized later,
-at the engineer review in `yad-ship`: merged as authored → `approved-unchanged`; edited first →
+at the engineer review in `yad-engineer-review`: merged as authored → `approved-unchanged`; edited first →
 `approved-with-edits`; scope/contract/checks halt → `rejected`.)
 
 ## Hard rules (build plan §B, Cross-cutting)

package/skills/yad-implement/references/implement-conventions.md

@@ -59,7 +59,7 @@ Co-Authored-By: CodeRabbit <noreply@coderabbit.ai>
 
 - Choose the entry whose `id` matches the tool that actually helped author the diff; add more than one
   line if several did. CodeRabbit is a co-author only when it **contributed code**, not when it merely
-  reviewed (that is `ai_review` in `yad-ship`).
+  reviewed (that is `ai_review` in `yad-engineer-review`).
 - For a fully human-authored commit, pick `id: none` — i.e. **omit** the trailer. `ai_coauthor.required`
   is `false`, so a missing trailer is valid and no gate fails on it.
 - `yad-implement` installs the `.gitmessage` template (`templates/.gitmessage`) and sets

package/skills/yad-open-pr/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: yad-open-pr
+description: 'Build-half helper of the gated SDLC. Open a code-repo task PR/MR from the committed platform template — detect GitHub/GitLab, push the current task branch, and create the PR/MR with the template body prefilled (Summary / Story-task / Impact & Risk) and the title defaulting to the commit subject. Auto-assigns from the hub roster: assignee = the committer, reviewers = the repo''s reviewers + domain-owners. High risk / contract surface routes to domain owners (risk-route.sh). Drives the `yad open-pr` CLI; never merges. Use when the user says "open the PR", "open the MR", or "raise the merge request".'
+---
+
+# SDLC — Open Task PR/MR (build-half helper)
+
+**Goal:** Open the PR/MR for the current task branch from the repo's committed PR/MR template
+(installed by `yad-pr-template`, Step D), with the body prefilled and the right reviewers requested.
+This is the standalone open-PR step; it **never merges** — the engineer review (`yad-engineer-review`,
+Step E) owns the merge. Distinct from `yad gate open`, which opens a front-half artifact-review PR on
+the product hub.
+
+## Conventions
+
+- Run **inside the code repo** under `{project-root}/demo-repos/<repo>/` (or pass `--repo <name>` to
+  resolve it from `.sdlc/repos.json`). The branch must be the task branch, not the default branch.
+- **Platform** is detected from the `origin` remote (or the registry / `--platform`).
+- **Title** — defaults to the last commit subject (one atomic task = one branch = one PR/MR), so it
+  follows the same Conventional-Commits style and passes the `pr-title` gate. Override with `--title`.
+- **Body** — the committed template (`.github/pull_request_template.md` /
+  `.gitlab/merge_request_templates/Default.md`) with `Task:`, `Risk level:`, `Contract surface
+  touched:`, and `Domains` prefilled; the rest is left for the author. This satisfies the `pr-template`
+  gate.
+- **Auto-assign** — from the hub roster scoped to this repo: assignee = the committer (resolved from
+  the local git identity), reviewers = the repo's `reviewer`/`domain-owner` logins minus the committer.
+  Degrades cleanly when there is no roster.
+- **Routing** — `low`/`medium` → base rule (owner + 1 reviewer); `high` (or a touched
+  contract/auth/payments surface) → plus one domain-owner per touched domain. `bash
+  checks/risk-route.sh <body>` prints the required reviewers.
+
+## Inputs
+
+- `repo`           — target a registered repo by name (optional; else the current dir).
+- `risk`           — `low|medium|high` (default `low`); prefilled into the body.
+- `contractChange` — flag; marks the contract surface touched and triggers escalation.
+- `base` / `platform` / `title` — optional overrides.
+
+## On Activation
+
+### Step 1 — Confirm the branch and template
+Confirm you are on the task branch (not the default branch) and that the PR/MR template is committed
+(if not, run `yad-pr-template` first). The branch's commits should already carry the `Task:` trailer.
+
+### Step 2 — Open the PR/MR
+Run from the repo root:
+```
+yad open-pr [--repo <name>] [--risk <level>] [--contract-change] [--title "<subject>"]
+```
+The CLI pushes the branch (sets upstream, the user's own auth), fills the template, and creates the
+PR/MR with the auto-assigned assignee + reviewers.
+
+### Step 3 — Route the review (if escalated)
+On `high` risk or a contract touch, run `bash checks/risk-route.sh <pr-body>` to print the required
+domain-owner reviewers — the same escalation `yad-engineer-review` enforces.
+
+### Step 4 — Stop (no merge)
+Report the PR/MR URL and the requested reviewers. The PR now runs the check gates (Step C); the human
+engineer review and merge happen in `yad-engineer-review` (Step E).
+
+## Hard rules
+
+- **One task = one branch = one PR/MR.** Never open a PR from the default branch.
+- **Title follows the commit subject** — Conventional-Commits style, so the `pr-title` gate passes.
+- **High risk routes to domain owners** — the same escalation as the gate; never a separate rule.
+- **Opening a PR never merges.** The human owns the merge in Step E.
+
+## Reference
+- The PR/MR template + the Impact & Risk block + routing: `../yad-pr-template/references/risk-routing.md`.
+- The gates the PR must pass: `../yad-checks/references/check-gates.md` (incl. `pr-title`, `pr-template`).
+- Commit first: `../yad-commit/SKILL.md`; commit + open in one step: `../yad-ship/SKILL.md`.
+- The engineer review + merge that follow: `../yad-engineer-review/SKILL.md`.

package/skills/yad-pr-template/SKILL.md

@@ -70,6 +70,11 @@ required reviewers:
   approval per touched domain — identical to `yad-review-gate`'s escalation. The actual approvals are
   recorded by the engineer review (Step E), via `yad-review-gate`.
 
+When the PR/MR is actually opened with `yad open-pr`, these reviewers are **requested automatically**
+from the repo-scoped roster (everyone with `reviewer`/`domain-owner` for the repo, minus the committer),
+and the **committer is set as the assignee**. `risk-route.sh` remains the advisory printout of who the
+gate will require.
+
 ### Step 4 — Stop (no auto-advance)
 Report what was committed (or the routing result). The template and routing are advisory inputs to the
 human review (Step E); they do not approve or merge. Do not touch the epic's `.sdlc/` state.

package/skills/yad-pr-template/templates/checks/pr-template.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# pr-template gate.
+# The PR/MR BODY must actually USE the committed template — i.e. carry its required sections so the
+# review (and risk-route.sh) has the inputs it needs. This catches an empty / free-form description
+# that bypassed the template.
+#   --profile code (default) — the code-repo task template (yad-pr-template templates/<platform>/):
+#     requires `## Summary`, `## Impact & Risk`, `## Checklist`, and a filled `Risk level:` (low|medium|high).
+#   --profile hub — the front-half artifact-review template (templates/hub/<platform>/):
+#     requires `## Artifact under review`, `## Impact & Risk (front-half)`, `## Checklist`, and a `Risk tags:` line.
+# The body is passed as a FILE path (single positional arg); CI writes the event body to a temp file
+# (GitHub: github.event.pull_request.body; GitLab: $CI_MERGE_REQUEST_DESCRIPTION).
+set -euo pipefail
+
+PROFILE=code
+ARGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --profile) PROFILE="${2:-code}"; shift 2 ;;
+    --profile=*) PROFILE="${1#*=}"; shift ;;
+    *) ARGS+=("$1"); shift ;;
+  esac
+done
+case "$PROFILE" in code|hub) ;; *) echo "FAIL [pr-template]: unknown --profile '$PROFILE' (code|hub)."; exit 1 ;; esac
+
+BODY="${ARGS[0]:-}"
+if [ -z "$BODY" ] || [ ! -f "$BODY" ]; then
+  echo "FAIL [pr-template]: body file not found — pass the PR/MR description as a file path."
+  exit 1
+fi
+
+rc=0
+require_heading() {
+  if ! grep -qiE "^[[:space:]]*$1[[:space:]]*$" "$BODY"; then
+    echo "FAIL [pr-template]: missing section '${2}' — the PR/MR body does not use the template."
+    rc=1
+  fi
+}
+
+if [ "$PROFILE" = hub ]; then
+  require_heading '## Artifact under review' '## Artifact under review'
+  require_heading '## Impact & Risk \(front-half\)' '## Impact & Risk (front-half)'
+  require_heading '## Checklist' '## Checklist'
+  if ! grep -qiE '(\*\*)?Risk tags:' "$BODY"; then
+    echo "FAIL [pr-template]: missing 'Risk tags:' line (front-half Impact & Risk)."
+    rc=1
+  fi
+else
+  require_heading '## Summary' '## Summary'
+  require_heading '## Impact & Risk' '## Impact & Risk'
+  require_heading '## Checklist' '## Checklist'
+  # Risk level must be present AND filled with a real value (not the <placeholder>).
+  rl="$(grep -iE '(\*\*)?Risk level:' "$BODY" | head -1 \
+        | sed -E 's/<!--.*$//; s/^[^:]*://; s/[*`]//g; s/^[[:space:]]*//; s/[[:space:]]*$//' || true)"
+  rl="$(printf '%s' "$rl" | tr 'A-Z' 'a-z' | grep -oE 'low|medium|high' | head -1 || true)"
+  if [ -z "$rl" ]; then
+    echo "FAIL [pr-template]: 'Risk level:' missing or not set to low|medium|high."
+    rc=1
+  fi
+fi
+
+[ "$rc" = 0 ] && echo "PASS [pr-template]: body uses the ${PROFILE} template (required sections present)."
+exit "$rc"

package/skills/yad-pr-template/templates/checks/pr-title.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# pr-title gate.
+# The PR/MR TITLE must follow the convention for its repo kind:
+#   --profile code (default) — a Conventional-Commits subject "<type>: <description>", no trailing
+#     period (config.yaml build.pr_title_style: same_as_commit_subject; one task = one PR, the title is
+#     the squash-merge subject). Keep <type> in sync with cli/manifest.mjs COMMIT_TYPES.
+#   --profile hub — a front-half artifact-review title "review: <artifact> (EP-<slug>)", the shape
+#     `yad gate open` creates (cli/gate.mjs).
+# The title is passed as the (single) positional arg; CI injects it from the event payload
+# (GitHub: github.event.pull_request.title; GitLab: $CI_MERGE_REQUEST_TITLE).
+set -euo pipefail
+
+PROFILE=code
+ARGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --profile) PROFILE="${2:-code}"; shift 2 ;;
+    --profile=*) PROFILE="${1#*=}"; shift ;;
+    *) ARGS+=("$1"); shift ;;
+  esac
+done
+case "$PROFILE" in code|hub) ;; *) echo "FAIL [pr-title]: unknown --profile '$PROFILE' (code|hub)."; exit 1 ;; esac
+
+TITLE="${ARGS[0]:-}"
+if [ -z "$TITLE" ]; then
+  echo "FAIL [pr-title]: empty title — pass the PR/MR title as the argument."
+  exit 1
+fi
+
+TYPES='feat|fix|docs|refactor|test|perf|build|ci|chore|revert'
+
+if [ "$PROFILE" = hub ]; then
+  # review: <artifact> (EP-<slug>)
+  if printf '%s' "$TITLE" | grep -qE '^review: .+ \(EP-[a-z0-9-]+\)$'; then
+    echo "PASS [pr-title]: '${TITLE}' (profile: hub)"
+    exit 0
+  fi
+  echo "FAIL [pr-title]: '${TITLE}' is not a hub review title 'review: <artifact> (EP-<slug>)'."
+  exit 1
+fi
+
+# code profile — Conventional-Commits subject (optional scope + breaking `!`), no trailing period.
+if ! printf '%s' "$TITLE" | grep -qE "^(${TYPES})(\([a-z0-9._-]+\))?!?: .+"; then
+  echo "FAIL [pr-title]: '${TITLE}' is not '<type>(<scope>)?!?: <description>' (type one of: ${TYPES//|/, })."
+  exit 1
+fi
+if printf '%s' "$TITLE" | grep -qE '\.$'; then
+  echo "FAIL [pr-title]: '${TITLE}' must not end with a period."
+  exit 1
+fi
+echo "PASS [pr-title]: '${TITLE}' (profile: code)"