yadflow 2.5.0 → 2.6.0

package/skills/yad-pr-template/templates/checks/pr-template.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# pr-template gate.
+# The PR/MR BODY must actually USE the committed template — i.e. carry its required sections so the
+# review (and risk-route.sh) has the inputs it needs. This catches an empty / free-form description
+# that bypassed the template.
+#   --profile code (default) — the code-repo task template (yad-pr-template templates/<platform>/):
+#     requires `## Summary`, `## Impact & Risk`, `## Checklist`, and a filled `Risk level:` (low|medium|high).
+#   --profile hub — the front-half artifact-review template (templates/hub/<platform>/):
+#     requires `## Artifact under review`, `## Impact & Risk (front-half)`, `## Checklist`, and a `Risk tags:` line.
+# The body is passed as a FILE path (single positional arg); CI writes the event body to a temp file
+# (GitHub: github.event.pull_request.body; GitLab: $CI_MERGE_REQUEST_DESCRIPTION).
+set -euo pipefail
+
+PROFILE=code
+ARGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --profile) PROFILE="${2:-code}"; shift 2 ;;
+    --profile=*) PROFILE="${1#*=}"; shift ;;
+    *) ARGS+=("$1"); shift ;;
+  esac
+done
+case "$PROFILE" in code|hub) ;; *) echo "FAIL [pr-template]: unknown --profile '$PROFILE' (code|hub)."; exit 1 ;; esac
+
+BODY="${ARGS[0]:-}"
+if [ -z "$BODY" ] || [ ! -f "$BODY" ]; then
+  echo "FAIL [pr-template]: body file not found — pass the PR/MR description as a file path."
+  exit 1
+fi
+
+rc=0
+require_heading() {
+  if ! grep -qiE "^[[:space:]]*$1[[:space:]]*$" "$BODY"; then
+    echo "FAIL [pr-template]: missing section '${2}' — the PR/MR body does not use the template."
+    rc=1
+  fi
+}
+
+if [ "$PROFILE" = hub ]; then
+  require_heading '## Artifact under review' '## Artifact under review'
+  require_heading '## Impact & Risk \(front-half\)' '## Impact & Risk (front-half)'
+  require_heading '## Checklist' '## Checklist'
+  if ! grep -qiE '(\*\*)?Risk tags:' "$BODY"; then
+    echo "FAIL [pr-template]: missing 'Risk tags:' line (front-half Impact & Risk)."
+    rc=1
+  fi
+else
+  require_heading '## Summary' '## Summary'
+  require_heading '## Impact & Risk' '## Impact & Risk'
+  require_heading '## Checklist' '## Checklist'
+  # Risk level must be present AND filled with a real value (not the <placeholder>).
+  rl="$(grep -iE '(\*\*)?Risk level:' "$BODY" | head -1 \
+        | sed -E 's/<!--.*$//; s/^[^:]*://; s/[*`]//g; s/^[[:space:]]*//; s/[[:space:]]*$//' || true)"
+  rl="$(printf '%s' "$rl" | tr 'A-Z' 'a-z' | grep -oE 'low|medium|high' | head -1 || true)"
+  if [ -z "$rl" ]; then
+    echo "FAIL [pr-template]: 'Risk level:' missing or not set to low|medium|high."
+    rc=1
+  fi
+fi
+
+[ "$rc" = 0 ] && echo "PASS [pr-template]: body uses the ${PROFILE} template (required sections present)."
+exit "$rc"

package/skills/yad-pr-template/templates/checks/pr-title.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# pr-title gate.
+# The PR/MR TITLE must follow the convention for its repo kind:
+#   --profile code (default) — a Conventional-Commits subject "<type>: <description>", no trailing
+#     period (config.yaml build.pr_title_style: same_as_commit_subject; one task = one PR, the title is
+#     the squash-merge subject). Keep <type> in sync with cli/manifest.mjs COMMIT_TYPES.
+#   --profile hub — a front-half artifact-review title "review: <artifact> (EP-<slug>)", the shape
+#     `yad gate open` creates (cli/gate.mjs).
+# The title is passed as the (single) positional arg; CI injects it from the event payload
+# (GitHub: github.event.pull_request.title; GitLab: $CI_MERGE_REQUEST_TITLE).
+set -euo pipefail
+
+PROFILE=code
+ARGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --profile) PROFILE="${2:-code}"; shift 2 ;;
+    --profile=*) PROFILE="${1#*=}"; shift ;;
+    *) ARGS+=("$1"); shift ;;
+  esac
+done
+case "$PROFILE" in code|hub) ;; *) echo "FAIL [pr-title]: unknown --profile '$PROFILE' (code|hub)."; exit 1 ;; esac
+
+TITLE="${ARGS[0]:-}"
+if [ -z "$TITLE" ]; then
+  echo "FAIL [pr-title]: empty title — pass the PR/MR title as the argument."
+  exit 1
+fi
+
+TYPES='feat|fix|docs|refactor|test|perf|build|ci|chore|revert'
+
+if [ "$PROFILE" = hub ]; then
+  # review: <artifact> (EP-<slug>)
+  if printf '%s' "$TITLE" | grep -qE '^review: .+ \(EP-[a-z0-9-]+\)$'; then
+    echo "PASS [pr-title]: '${TITLE}' (profile: hub)"
+    exit 0
+  fi
+  echo "FAIL [pr-title]: '${TITLE}' is not a hub review title 'review: <artifact> (EP-<slug>)'."
+  exit 1
+fi
+
+# code profile — Conventional-Commits subject (optional scope + breaking `!`), no trailing period.
+if ! printf '%s' "$TITLE" | grep -qE "^(${TYPES})(\([a-z0-9._-]+\))?!?: .+"; then
+  echo "FAIL [pr-title]: '${TITLE}' is not '<type>(<scope>)?!?: <description>' (type one of: ${TYPES//|/, })."
+  exit 1
+fi
+if printf '%s' "$TITLE" | grep -qE '\.$'; then
+  echo "FAIL [pr-title]: '${TITLE}' must not end with a period."
+  exit 1
+fi
+echo "PASS [pr-title]: '${TITLE}' (profile: code)"

package/skills/yad-run/SKILL.md

@@ -70,7 +70,7 @@ Walk the steps for `repo` starting at `from`/`currentStep`. For each step:
      the next step, and **continue the loop** (this is the Step B auto-advance for `checks`).
    - else (**`human_approve`**) → set the step `done`/`in_review`, **stop** and report
      "waiting for a human at `<next-step>`".
-5. **Always stop at `engineer-review`** (it is `locked`): hand off to `yad-ship` for the human merge
+5. **Always stop at `engineer-review`** (it is `locked`): hand off to `yad-engineer-review` for the human merge
    gate, which finalizes the trust verdict (confirm/override the provisional one).
 
 ### `action: set-dial` — earn (or revert) a step's automation
@@ -106,4 +106,4 @@ reversible (build plan §Safety). Report the new state and that `yad-status` wil
 - The loop, the trust-verdict derivation, and the threshold predicate: `references/run-loop.md`.
 - State/trust schemas: `../yad-epic/references/state-schema.md`.
 - The steps it drives: `../yad-spec/`, `../yad-implement/`, `../yad-checks/`; the human gate it
-  hands off to: `../yad-ship/`.
+  hands off to: `../yad-engineer-review/`.

package/skills/yad-run/references/run-loop.md

@@ -14,7 +14,7 @@ spec → tasks → implement → checks → engineer-review(locked)
 
 `spec` and `tasks` are the two legs of `yad-spec` (the heavy ceremony, then the atomic `tasks.md`).
 `implement` is one atomic task via `yad-implement`. `checks` is `yad-checks (action: run)`.
-`engineer-review` is the human gate at `yad-ship` — always a stop, never automated.
+`engineer-review` is the human gate at `yad-engineer-review` — always a stop, never automated.
 
 ## The loop (pseudocode)
 
@@ -40,7 +40,7 @@ while step is a back step (not engineer-review):
     else:  # human_approve
         bs.step.status = "done"; persist; STOP and report "waiting for human at <next>"
 
-# reached engineer-review: always stop, hand to yad-ship (human gate, finalizes the verdict)
+# reached engineer-review: always stop, hand to yad-engineer-review (human gate, finalizes the verdict)
 ```
 
 `ranBy` is `machine` when the *previous* step's effective dial caused this step to run without a human
@@ -62,7 +62,7 @@ per-step dial says. `engineer-review` and the five front states are covered by `
 ## Deriving signals & the provisional verdict
 
 `signals` are the raw facts of the run; the **provisional `verdict`** is derived from them. The human
-gate for each step (the engineer review at `yad-ship` for `implement`; spec acceptance for `spec`;
+gate for each step (the engineer review at `yad-engineer-review` for `implement`; spec acceptance for `spec`;
 first-consume for `tasks`; the gate itself for `checks`) later confirms or overrides the verdict and
 finalizes the entry — a human always has the last word on the trust signal.
 
@@ -114,7 +114,7 @@ Reverting (`to: human_approve`) is never gated — automation must be reversible
 
 ## What stays human, always
 
-- `engineer-review` — the merge gate. `yad-run` always stops here and hands to `yad-ship`.
+- `engineer-review` — the merge gate. `yad-run` always stops here and hands to `yad-engineer-review`.
 - The five front states (`epic`, `architecture`, `ui-design`, `stories`, `test-cases`) — not in
   `back_steps`, in `locked_steps`; the dial-setter refuses them.
 - Any contract-surface change — halts the loop and routes back to the architecture gate, regardless of

package/skills/yad-ship/SKILL.md

@@ -1,86 +1,64 @@
 ---
 name: yad-ship
-description: 'Build-half Step E of the gated SDLC — AI review, engineer review, then ship. Wire an advisory AI first-pass (CodeRabbit) on the PR/MR; record the human engineer review with the same human_approve discipline as the front gates (owner + 1 reviewer, escalating to domain owners on high risk / contract / auth / payments — the Step D routing); and on merge, record the ship in the epic build-log and update the story state so the epic → story → task → PR chain is traceable. Never auto-advances — the human owns the merge. Use when the user says "ship this task", "record the engineer review", or "wire the AI review".'
+description: 'Build-half helper of the gated SDLC — commit AND open the task PR/MR in one step. A thin orchestration over yad-commit then yad-open-pr: commit the staged atomic change by the conventions (Conventional-Commits subject, Task → Contract-Change → Co-Authored-By trailers, --ai footer, ≤3-file atomic guard), then push the branch and open the PR/MR from the committed template with the roster auto-assigned. The PR step runs ONLY if the commit lands (a failed commit, tripped guard, or --dry-run stops before pushing). Drives the `yad ship` CLI; never merges. Use when the user says "ship this task", "commit and open the PR", or "commit and raise the MR". (For the engineer review + merge, use yad-engineer-review.)'
 ---
 
-# SDLC — Review & Ship (build-half Step E)
+# SDLC — Commit + Open PR/MR (build-half helper)
 
-**Goal:** Take a task PR/MR that has passed the **check gates** (Step C) through two sets of eyes and
-out to production: an **AI first-pass** (advisory) and a **human engineer review** (the authority),
-then **ship** — merge, record the ship, and update the story state. This is the last build-half step
-(build plan §E). It is a **human gate**, the same `human_approve` discipline as the front states:
-**nothing auto-advances**; the engineer owns the merge.
+**Goal:** Do the two routine build-half hand-actions for ONE atomic task in a single step — **commit by
+convention, then open the task PR/MR** — so an implemented diff becomes a reviewable PR/MR without two
+separate invocations. It is a thin wrapper over `yad-commit` and `yad-open-pr`; it holds no logic of
+its own and **never merges**. The engineer review + merge are Step E (`yad-engineer-review`).
 
 ## Conventions
 
-- `{project-root}` resolves from the project working directory — the **product** repo (the source of
-  truth: it holds the story and the build ledger).
-- Code repos are separate git repos under `{project-root}/demo-repos/<repo>/`.
-- The build ledger is `{project-root}/epics/<epic>/.sdlc/build-log.json` (append-only).
-- The engineer-review rule reuses `yad-review-gate`: base = at least one `owner` AND one distinct
-  `reviewer`; **escalated** (the PR's Impact & Risk is `high`, or it touches contract/auth/payments) =
-  base PLUS one `domain-owner` per touched domain — the same routing `yad-pr-template`'s
-  `risk-route.sh` prints.
-- AI review wiring: `templates/.coderabbit.yaml` → `<repo>/.coderabbit.yaml`.
+- Run **inside the code repo** under `{project-root}/demo-repos/<repo>/` (or `--repo <name>`), on the
+  task branch with the atomic change **already staged** (`git add`).
+- Inherits every convention of the two steps it wraps:
+  - Commit: subject `<type>: <lowercase imperative, no trailing period>`, fixed trailer order
+    `Task → Contract-Change → Co-Authored-By`, the `--ai` co-author footer, the ≤3-file atomic guard
+    (`../yad-commit/SKILL.md`).
+  - PR/MR: pushed branch, the committed template prefilled, title defaulting to the commit subject,
+    roster auto-assign, risk routing (`../yad-open-pr/SKILL.md`).
+- **Order matters:** the PR/MR is opened **only if the commit lands**. A failed commit, a tripped
+  atomic guard, or `--dry-run` stops the step before anything is pushed.
 
 ## Inputs
 
-- `epic` / `story` / `task` / `repo` — the PR under review (the task branch `feat/<story>-<task>-…`).
-- `action` — `ai-review` | `approve` | `ship` (default `ai-review`).
-- For `approve`: the reviewer `name` and `role` (`owner` | `reviewer` | `domain-owner`), and for a
-  domain owner the `domain`.
+- `type` / `message` — the commit type + subject (required), `--type <t> -m "<subject>"`.
+- `ai`              — co-author footer: `claude|copilot|cursor|coderabbit|none` (default `none`).
+- `task`           — Task trailer (optional; derived from the branch when omitted).
+- `contractChange` — flag; marks the contract surface touched (commit trailer + PR escalation).
+- `repo` / `risk` / `base` / `platform` / `title` — PR/MR options (see `yad-open-pr`).
 
 ## On Activation
 
-### Step 1 — `ai-review` (advisory first pass)
-Ensure the AI reviewer is wired: copy `templates/.coderabbit.yaml` to `<repo>/.coderabbit.yaml` (commit
-on the default branch if missing). CodeRabbit reviews each PR automatically and posts comments — it is
-a **second set of eyes, never the authority**: it cannot approve or merge. Where CodeRabbit can't run
-(no remote), run an equivalent AI first-pass by hand and capture its notes. Record that the AI review
-ran; surface its findings to the engineer. Do **not** treat AI approval as a gate.
+### Step 1 — Confirm the staged atomic change
+Confirm you are on the task branch (not the default branch) and the atomic change is staged within its
+file boundary. Preview the commit with `--dry-run` if unsure.
 
-### Step 2 — `approve` (the engineer review — the human gate)
-A human engineer reads the diff **against the spec** (`specs/<story>/`) and the acceptance criteria,
-and records an approval. Determine the rule from the PR's Impact & Risk block (run
-`../yad-pr-template/templates/checks/risk-route.sh` on the PR body): base, or escalated to a
-domain-owner per touched domain. Record each approval; re-evaluate whether the rule is satisfied.
-Recording an approval does **not** ship — shipping is a separate, explicit step. Front-half discipline:
-the gate talks only through files; refuse to treat AI review as a human approval.
+### Step 2 — Commit + open in one step
+Run from the repo root:
+```
+yad ship --type <type> -m "<subject>" [--ai <id>] [--task <id>] [--contract-change] \
+         [--repo <name>] [--risk <level>] [--title "<subject>"]
+```
+The CLI runs `yad commit` and, only if it succeeds, `yad open-pr` — committing the change, pushing the
+branch, and opening the PR/MR with the template prefilled and reviewers auto-assigned.
 
-### Step 3 — `ship` (merge + record + update state)
-Ship **iff ALL hold**: the check gates pass (Step C), the AI review has run (advisory), and the
-engineer-review rule is satisfied (Step 2). Then:
-- **Merge** the task branch into the repo's default branch (the human performs/authorises the merge).
-- **Record the ship** — append to `epics/<epic>/.sdlc/build-log.json`:
-  ```json
-  { "story": "<story>", "task": "<task>", "repo": "<repo>", "branch": "feat/<story>-<task>-…",
-    "pr": "<url|#>", "mergeCommit": "<sha>", "gates": ["spec-link","contract-check","build-test-lint"],
-    "ai_review": "coderabbit (advisory)", "engineer_review": [{"approver":"<name>","role":"<role>","domain":"<opt>"}],
-    "risk": "<low|medium|high>", "shippedAt": "<YYYY-MM-DD>" }
-  ```
-- **Update the story state** — when **every** task in `specs/<story>/tasks.md` has a ship record, set
-  the story frontmatter `status: shipped`; otherwise `status: in-build`. The chain
-  **epic → story → task → PR → mergeCommit** is now traceable end to end.
-- **Finalize the trust verdict (Phase 4).** If this story has a `build-state/<story>.json` (it ran
-  through `yad-run`), the engineer **confirms or overrides** the provisional trust verdict that the
-  orchestrator derived for this run, and the final verdict is written to
-  `epics/<epic>/.sdlc/trust-log.json`. The human has the last word on the trust signal: a diff merged
-  as authored is `approved-unchanged`; one the engineer edited before merge is `approved-with-edits`;
-  a rejected one is `rejected`. This is the evidence that later earns a step its `machine_advance`
-  (it never weakens the merge gate — the engineer still owns the merge).
+### Step 3 — Route + stop (no merge)
+On `high` risk or a contract touch, run `bash checks/risk-route.sh <pr-body>` for the required
+domain-owner reviewers. Report the commit + the PR/MR URL. The PR now runs the check gates (Step C);
+the engineer review and merge are Step E (`yad-engineer-review`).
 
-### Step 4 — Stop
-Report what shipped and the story's state. Do not advance anything else; the front-half `state.json`
-stays as it was (`ready-for-build`). The build half is recorded in `build-log.json` + the story status.
+## Hard rules
 
-## Hard rules (build plan §E, Cross-cutting)
-
-- **AI review is advisory, never the authority.** Only a human engineer approval counts toward the gate.
-- **High risk routes to domain owners** — the same escalation as `yad-review-gate` / `risk-route.sh`.
-- **Ship only after gates + engineer review.** No gate skipped; the human owns the merge.
-- **Nothing auto-advances.** Step E records human decisions in files; it never machine-advances.
+- **One staged atomic task = one commit = one PR/MR.** Never bundle; never open from the default branch.
+- **No PR without a landed commit.** A failed/`--dry-run` commit stops the step before pushing.
+- **High risk routes to domain owners** — the same escalation as the gate.
+- **Shipping here never merges.** The human owns the merge in `yad-engineer-review`.
 
 ## Reference
-- The build ledger + story-state rules: `references/ship-and-record.md`.
-- The escalation reused: `../yad-review-gate/SKILL.md`; the routing helper: `../yad-pr-template/`.
-- The gates that must pass first: `../yad-checks/references/check-gates.md`.
+- The two steps this wraps: `../yad-commit/SKILL.md` and `../yad-open-pr/SKILL.md`.
+- The gates the PR must pass: `../yad-checks/references/check-gates.md`.
+- The engineer review + merge that follow: `../yad-engineer-review/SKILL.md`.

package/skills/yad-spec/SKILL.md

@@ -101,7 +101,7 @@ verdict is **anchored to the human who accepts the spec**, never self-graded:
   `human_edited_spec: true`);
 - the spec is rejected or the ceremony re-run → `rejected`.
 `yad-run` records a provisional entry when the spec is generated; this acceptance finalizes it (same
-pattern as the engineer review finalizing `implement` at `yad-ship`). Append the finalized entry to
+pattern as the engineer review finalizing `implement` at `yad-engineer-review`). Append the finalized entry to
 `epics/<epic>/.sdlc/trust-log.json` (schema:
 `../yad-epic/references/state-schema.md`). **Run standalone, no trust entry is written** — the
 log measures orchestrated runs. `spec` stays `human_approve` until its slice clears the threshold;