yadflow 2.4.2 → 2.6.0

package/skills/yad-review-gate/references/gating.md

@@ -63,8 +63,14 @@ on a real PR/MR instead of (or as well as) the skill recording it directly. `act
 tagged `"source": "bridge"`. **The predicate above is unchanged**: it counts owner/reviewer/domain-owner
 approvals regardless of how they were recorded.
 
-- login → role via the roster; `domain-owner` derived when a roster `name` equals a repo's `domain_owner`
-  and that repo is a touched domain; an unmapped login is a plain `reviewer`, never promoted.
+- login → role(s) via the roster's **per-scope map** (`roles: { hub: [...], <repo>: [...] }`): a person
+  can hold owner + reviewer + domain-owner at once, and a repo can list several people per role. The
+  `hub` roles plus each touched domain's `roles[<repo>]` are emitted; `domain-owner` is also **derived**
+  when a roster `name` equals a repo's `domain_owner`/`domain_owners` (legacy fallback) and that repo is a
+  touched domain; an unmapped login is a plain `reviewer`, never promoted.
+- On PR/MR open the assignee is the committer and reviewers are the scope's `reviewer` + `domain-owner`
+  members (minus the committer); the owner/author is recorded, not requested. See
+  `../yad-hub-bridge/references/login-roster.md`.
 - `sync` is idempotent (upsert by `(step, approver, role, domain)`; supersede revoked; key comments on
   comment id) and never touches **manual** approvals.
 - The architecture+contract staleness rule applies to bridge approvals too: a re-lock discards bridge

package/skills/yad-run/SKILL.md

@@ -70,7 +70,7 @@ Walk the steps for `repo` starting at `from`/`currentStep`. For each step:
      the next step, and **continue the loop** (this is the Step B auto-advance for `checks`).
    - else (**`human_approve`**) → set the step `done`/`in_review`, **stop** and report
      "waiting for a human at `<next-step>`".
-5. **Always stop at `engineer-review`** (it is `locked`): hand off to `yad-ship` for the human merge
+5. **Always stop at `engineer-review`** (it is `locked`): hand off to `yad-engineer-review` for the human merge
    gate, which finalizes the trust verdict (confirm/override the provisional one).
 
 ### `action: set-dial` — earn (or revert) a step's automation
@@ -106,4 +106,4 @@ reversible (build plan §Safety). Report the new state and that `yad-status` wil
 - The loop, the trust-verdict derivation, and the threshold predicate: `references/run-loop.md`.
 - State/trust schemas: `../yad-epic/references/state-schema.md`.
 - The steps it drives: `../yad-spec/`, `../yad-implement/`, `../yad-checks/`; the human gate it
-  hands off to: `../yad-ship/`.
+  hands off to: `../yad-engineer-review/`.

package/skills/yad-run/references/run-loop.md

@@ -14,7 +14,7 @@ spec → tasks → implement → checks → engineer-review(locked)
 
 `spec` and `tasks` are the two legs of `yad-spec` (the heavy ceremony, then the atomic `tasks.md`).
 `implement` is one atomic task via `yad-implement`. `checks` is `yad-checks (action: run)`.
-`engineer-review` is the human gate at `yad-ship` — always a stop, never automated.
+`engineer-review` is the human gate at `yad-engineer-review` — always a stop, never automated.
 
 ## The loop (pseudocode)
 
@@ -40,7 +40,7 @@ while step is a back step (not engineer-review):
     else:  # human_approve
         bs.step.status = "done"; persist; STOP and report "waiting for human at <next>"
 
-# reached engineer-review: always stop, hand to yad-ship (human gate, finalizes the verdict)
+# reached engineer-review: always stop, hand to yad-engineer-review (human gate, finalizes the verdict)
 ```
 
 `ranBy` is `machine` when the *previous* step's effective dial caused this step to run without a human
@@ -62,7 +62,7 @@ per-step dial says. `engineer-review` and the five front states are covered by `
 ## Deriving signals & the provisional verdict
 
 `signals` are the raw facts of the run; the **provisional `verdict`** is derived from them. The human
-gate for each step (the engineer review at `yad-ship` for `implement`; spec acceptance for `spec`;
+gate for each step (the engineer review at `yad-engineer-review` for `implement`; spec acceptance for `spec`;
 first-consume for `tasks`; the gate itself for `checks`) later confirms or overrides the verdict and
 finalizes the entry — a human always has the last word on the trust signal.
 
@@ -114,7 +114,7 @@ Reverting (`to: human_approve`) is never gated — automation must be reversible
 
 ## What stays human, always
 
-- `engineer-review` — the merge gate. `yad-run` always stops here and hands to `yad-ship`.
+- `engineer-review` — the merge gate. `yad-run` always stops here and hands to `yad-engineer-review`.
 - The five front states (`epic`, `architecture`, `ui-design`, `stories`, `test-cases`) — not in
   `back_steps`, in `locked_steps`; the dial-setter refuses them.
 - Any contract-surface change — halts the loop and routes back to the architecture gate, regardless of

package/skills/yad-ship/SKILL.md

@@ -1,86 +1,64 @@
 ---
 name: yad-ship
-description: 'Build-half Step E of the gated SDLC — AI review, engineer review, then ship. Wire an advisory AI first-pass (CodeRabbit) on the PR/MR; record the human engineer review with the same human_approve discipline as the front gates (owner + 1 reviewer, escalating to domain owners on high risk / contract / auth / payments — the Step D routing); and on merge, record the ship in the epic build-log and update the story state so the epic → story → task → PR chain is traceable. Never auto-advances — the human owns the merge. Use when the user says "ship this task", "record the engineer review", or "wire the AI review".'
+description: 'Build-half helper of the gated SDLC — commit AND open the task PR/MR in one step. A thin orchestration over yad-commit then yad-open-pr: commit the staged atomic change by the conventions (Conventional-Commits subject, Task → Contract-Change → Co-Authored-By trailers, --ai footer, ≤3-file atomic guard), then push the branch and open the PR/MR from the committed template with the roster auto-assigned. The PR step runs ONLY if the commit lands (a failed commit, tripped guard, or --dry-run stops before pushing). Drives the `yad ship` CLI; never merges. Use when the user says "ship this task", "commit and open the PR", or "commit and raise the MR". (For the engineer review + merge, use yad-engineer-review.)'
 ---
 
-# SDLC — Review & Ship (build-half Step E)
+# SDLC — Commit + Open PR/MR (build-half helper)
 
-**Goal:** Take a task PR/MR that has passed the **check gates** (Step C) through two sets of eyes and
-out to production: an **AI first-pass** (advisory) and a **human engineer review** (the authority),
-then **ship** — merge, record the ship, and update the story state. This is the last build-half step
-(build plan §E). It is a **human gate**, the same `human_approve` discipline as the front states:
-**nothing auto-advances**; the engineer owns the merge.
+**Goal:** Do the two routine build-half hand-actions for ONE atomic task in a single step — **commit by
+convention, then open the task PR/MR** — so an implemented diff becomes a reviewable PR/MR without two
+separate invocations. It is a thin wrapper over `yad-commit` and `yad-open-pr`; it holds no logic of
+its own and **never merges**. The engineer review + merge are Step E (`yad-engineer-review`).
 
 ## Conventions
 
-- `{project-root}` resolves from the project working directory — the **product** repo (the source of
-  truth: it holds the story and the build ledger).
-- Code repos are separate git repos under `{project-root}/demo-repos/<repo>/`.
-- The build ledger is `{project-root}/epics/<epic>/.sdlc/build-log.json` (append-only).
-- The engineer-review rule reuses `yad-review-gate`: base = at least one `owner` AND one distinct
-  `reviewer`; **escalated** (the PR's Impact & Risk is `high`, or it touches contract/auth/payments) =
-  base PLUS one `domain-owner` per touched domain — the same routing `yad-pr-template`'s
-  `risk-route.sh` prints.
-- AI review wiring: `templates/.coderabbit.yaml` → `<repo>/.coderabbit.yaml`.
+- Run **inside the code repo** under `{project-root}/demo-repos/<repo>/` (or `--repo <name>`), on the
+  task branch with the atomic change **already staged** (`git add`).
+- Inherits every convention of the two steps it wraps:
+  - Commit: subject `<type>: <lowercase imperative, no trailing period>`, fixed trailer order
+    `Task → Contract-Change → Co-Authored-By`, the `--ai` co-author footer, the ≤3-file atomic guard
+    (`../yad-commit/SKILL.md`).
+  - PR/MR: pushed branch, the committed template prefilled, title defaulting to the commit subject,
+    roster auto-assign, risk routing (`../yad-open-pr/SKILL.md`).
+- **Order matters:** the PR/MR is opened **only if the commit lands**. A failed commit, a tripped
+  atomic guard, or `--dry-run` stops the step before anything is pushed.
 
 ## Inputs
 
-- `epic` / `story` / `task` / `repo` — the PR under review (the task branch `feat/<story>-<task>-…`).
-- `action` — `ai-review` | `approve` | `ship` (default `ai-review`).
-- For `approve`: the reviewer `name` and `role` (`owner` | `reviewer` | `domain-owner`), and for a
-  domain owner the `domain`.
+- `type` / `message` — the commit type + subject (required), `--type <t> -m "<subject>"`.
+- `ai`              — co-author footer: `claude|copilot|cursor|coderabbit|none` (default `none`).
+- `task`           — Task trailer (optional; derived from the branch when omitted).
+- `contractChange` — flag; marks the contract surface touched (commit trailer + PR escalation).
+- `repo` / `risk` / `base` / `platform` / `title` — PR/MR options (see `yad-open-pr`).
 
 ## On Activation
 
-### Step 1 — `ai-review` (advisory first pass)
-Ensure the AI reviewer is wired: copy `templates/.coderabbit.yaml` to `<repo>/.coderabbit.yaml` (commit
-on the default branch if missing). CodeRabbit reviews each PR automatically and posts comments — it is
-a **second set of eyes, never the authority**: it cannot approve or merge. Where CodeRabbit can't run
-(no remote), run an equivalent AI first-pass by hand and capture its notes. Record that the AI review
-ran; surface its findings to the engineer. Do **not** treat AI approval as a gate.
+### Step 1 — Confirm the staged atomic change
+Confirm you are on the task branch (not the default branch) and the atomic change is staged within its
+file boundary. Preview the commit with `--dry-run` if unsure.
 
-### Step 2 — `approve` (the engineer review — the human gate)
-A human engineer reads the diff **against the spec** (`specs/<story>/`) and the acceptance criteria,
-and records an approval. Determine the rule from the PR's Impact & Risk block (run
-`../yad-pr-template/templates/checks/risk-route.sh` on the PR body): base, or escalated to a
-domain-owner per touched domain. Record each approval; re-evaluate whether the rule is satisfied.
-Recording an approval does **not** ship — shipping is a separate, explicit step. Front-half discipline:
-the gate talks only through files; refuse to treat AI review as a human approval.
+### Step 2 — Commit + open in one step
+Run from the repo root:
+```
+yad ship --type <type> -m "<subject>" [--ai <id>] [--task <id>] [--contract-change] \
+         [--repo <name>] [--risk <level>] [--title "<subject>"]
+```
+The CLI runs `yad commit` and, only if it succeeds, `yad open-pr` — committing the change, pushing the
+branch, and opening the PR/MR with the template prefilled and reviewers auto-assigned.
 
-### Step 3 — `ship` (merge + record + update state)
-Ship **iff ALL hold**: the check gates pass (Step C), the AI review has run (advisory), and the
-engineer-review rule is satisfied (Step 2). Then:
-- **Merge** the task branch into the repo's default branch (the human performs/authorises the merge).
-- **Record the ship** — append to `epics/<epic>/.sdlc/build-log.json`:
-  ```json
-  { "story": "<story>", "task": "<task>", "repo": "<repo>", "branch": "feat/<story>-<task>-…",
-    "pr": "<url|#>", "mergeCommit": "<sha>", "gates": ["spec-link","contract-check","build-test-lint"],
-    "ai_review": "coderabbit (advisory)", "engineer_review": [{"approver":"<name>","role":"<role>","domain":"<opt>"}],
-    "risk": "<low|medium|high>", "shippedAt": "<YYYY-MM-DD>" }
-  ```
-- **Update the story state** — when **every** task in `specs/<story>/tasks.md` has a ship record, set
-  the story frontmatter `status: shipped`; otherwise `status: in-build`. The chain
-  **epic → story → task → PR → mergeCommit** is now traceable end to end.
-- **Finalize the trust verdict (Phase 4).** If this story has a `build-state/<story>.json` (it ran
-  through `yad-run`), the engineer **confirms or overrides** the provisional trust verdict that the
-  orchestrator derived for this run, and the final verdict is written to
-  `epics/<epic>/.sdlc/trust-log.json`. The human has the last word on the trust signal: a diff merged
-  as authored is `approved-unchanged`; one the engineer edited before merge is `approved-with-edits`;
-  a rejected one is `rejected`. This is the evidence that later earns a step its `machine_advance`
-  (it never weakens the merge gate — the engineer still owns the merge).
+### Step 3 — Route + stop (no merge)
+On `high` risk or a contract touch, run `bash checks/risk-route.sh <pr-body>` for the required
+domain-owner reviewers. Report the commit + the PR/MR URL. The PR now runs the check gates (Step C);
+the engineer review and merge are Step E (`yad-engineer-review`).
 
-### Step 4 — Stop
-Report what shipped and the story's state. Do not advance anything else; the front-half `state.json`
-stays as it was (`ready-for-build`). The build half is recorded in `build-log.json` + the story status.
+## Hard rules
 
-## Hard rules (build plan §E, Cross-cutting)
-
-- **AI review is advisory, never the authority.** Only a human engineer approval counts toward the gate.
-- **High risk routes to domain owners** — the same escalation as `yad-review-gate` / `risk-route.sh`.
-- **Ship only after gates + engineer review.** No gate skipped; the human owns the merge.
-- **Nothing auto-advances.** Step E records human decisions in files; it never machine-advances.
+- **One staged atomic task = one commit = one PR/MR.** Never bundle; never open from the default branch.
+- **No PR without a landed commit.** A failed/`--dry-run` commit stops the step before pushing.
+- **High risk routes to domain owners** — the same escalation as the gate.
+- **Shipping here never merges.** The human owns the merge in `yad-engineer-review`.
 
 ## Reference
-- The build ledger + story-state rules: `references/ship-and-record.md`.
-- The escalation reused: `../yad-review-gate/SKILL.md`; the routing helper: `../yad-pr-template/`.
-- The gates that must pass first: `../yad-checks/references/check-gates.md`.
+- The two steps this wraps: `../yad-commit/SKILL.md` and `../yad-open-pr/SKILL.md`.
+- The gates the PR must pass: `../yad-checks/references/check-gates.md`.
+- The engineer review + merge that follow: `../yad-engineer-review/SKILL.md`.

package/skills/yad-spec/SKILL.md

@@ -101,7 +101,7 @@ verdict is **anchored to the human who accepts the spec**, never self-graded:
   `human_edited_spec: true`);
 - the spec is rejected or the ceremony re-run → `rejected`.
 `yad-run` records a provisional entry when the spec is generated; this acceptance finalizes it (same
-pattern as the engineer review finalizing `implement` at `yad-ship`). Append the finalized entry to
+pattern as the engineer review finalizing `implement` at `yad-engineer-review`). Append the finalized entry to
 `epics/<epic>/.sdlc/trust-log.json` (schema:
 `../yad-epic/references/state-schema.md`). **Run standalone, no trust entry is written** — the
 log measures orchestrated runs. `spec` stays `human_approve` until its slice clears the threshold;