yadflow 3.18.1 → 4.0.0-next.1

package/cli/reconcile.mjs

@@ -10,10 +10,10 @@ import {
 const readFileSafe = (p) => { try { return fs.readFileSync(p, 'utf8'); } catch { return ''; } };
 
 import { preflightGuardReadiness } from './hubcommit.mjs';
-import { VERSION, PROJECT_FILES, MANAGED_LEDGER, BACKUP_SUFFIX } from './manifest.mjs';
+import { VERSION, PROJECT_FILES, MANAGED_LEDGER, BACKUP_SUFFIX , productConfigPath } from './manifest.mjs';
 import {
-  moduleActions, repoActions, hubActions, hookActions, authorsActions,
-  legacyModuleActions, removedModuleActions, legacyRepoActions, legacyHubActions,
+  moduleActions, repoActions, productActions, hookActions,
+  legacyModuleActions, removedModuleActions, orphanHookActions, legacyRepoActions, legacyHubActions,
   ideTargetStateFor, recordManagedWrites,
 } from './plan.mjs';
 import { gitHead, packRepo } from './setup.mjs';
@@ -21,6 +21,9 @@ import { groupByRoot, commitUpdates, repoLabel } from './update-commit.mjs';
 
 const MARK = { missing: c.red('missing'), new: c.cyan('new'), outdated: c.yellow('outdated'), modified: c.cyan('modified'), stale: c.yellow('stale'), legacy: c.yellow('legacy'), removed: c.yellow('removed'), ok: c.green('ok') };
 
+// The --json answer's list (E1): every managed item, as the report groups it — never the apply step.
+const itemsOf = (actions) => actions.map((a) => ({ scope: a.scope, item: a.item, status: a.status }));
+
 export async function reconcile(root, { fix = false, scope = 'all', force = false, push = false, allowBranch = false, overwriteLocal = false } = {}) {
   log(c.bold(`\nSDLC reconcile  ${c.dim('v' + VERSION)}`));
   log(c.dim(`target: ${root}\n`));
@@ -28,7 +31,7 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   // --- missing one-time setup (needs the interactive wizard) ---
   const gaps = [];
   if (!exists(path.join(root, PROJECT_FILES.version))) gaps.push('module not installed (.sdlc/cli-version.json absent)');
-  if (!exists(path.join(root, PROJECT_FILES.hubConfig))) gaps.push('hub not configured (.sdlc/hub.json absent)');
+  if (!exists(productConfigPath(root))) gaps.push('hub not configured (.sdlc/hub.json absent)');
   const registry = readJSON(path.join(root, PROJECT_FILES.reposRegistry), { repos: [] });
   if (!exists(path.join(root, PROJECT_FILES.reposRegistry))) gaps.push('no repos registered (.sdlc/repos.json absent)');
 
@@ -43,13 +46,13 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
     writeJSON(stampPath, { ...record, version: VERSION, ideTargets });
   };
 
-  // --- deterministic file actions (module + hub CI + author allowlists + every registered repo),
+  // --- deterministic file actions (module + Product CI + every registered repo),
   //     plus pre-2.0 sdlc-* -> yad-* migrations ('legacy': old name installed; rename in place)
   //     and purge of skills removed in a later release ('removed': delete the lingering install) ---
   const actions = [
     ...moduleActions(root, ideTargets), ...legacyModuleActions(root, ideTargets), ...removedModuleActions(root, ideTargets),
-    ...hubActions(root), ...legacyHubActions(root), ...hookActions(root, ideTargets),
-    ...authorsActions(root, registry.repos),
+    ...productActions(root), ...legacyHubActions(root), ...hookActions(root, ideTargets),
+    ...orphanHookActions(root, ideTargets),
   ];
   if (ideState.needsRepair) {
     actions.push({
@@ -71,7 +74,7 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
     if (head && repo.syncedHead && head !== repo.syncedHead) {
       staleRepos.push(repo);
       // packRepo writes the repomix cache under the HUB root (root/repo.contextPack, e.g.
-      // .sdlc/code-context/<name>/pack.md), so the touched path belongs to the hub — and is commonly
+      // .sdlc/code-context/<name>/pack.md), so the touched path belongs to the Product — and is commonly
       // gitignored, in which case the push stage's check-ignore drops it. codeMap is AI-generated
       // later, not here, so only the pack is claimed.
       actions.push({
@@ -132,6 +135,26 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   for (const m of modified) {
     warn(`${m.scope}/${m.item} is locally modified — it matches neither the shipped template nor the copy yad wrote`);
   }
+  // A gate-sync fragment is kept like any other edited file — but it also decides which yadflow CI runs.
+  // It trusts a committed version only from its own major (`YAD_MAJOR`), and the version stamp is
+  // re-written below whatever happens to the fragment. So an edited fragment left on an older major
+  // rejects the stamp this update writes, and CI silently floats on that older engine against a project
+  // on a newer file shape. The generic "locally modified" line does not say that; this does.
+  const pinMajorOf = (file) => {
+    try {
+      const text = fs.readFileSync(file, 'utf8');
+      // `YAD_MAJOR=<n>` from this release on; before it, the major was written into the check itself.
+      const found = text.match(/^\s*YAD_MAJOR=(\d+)\s*$/m) || text.match(/grep -Eq ['"]\^(\d+)\\\./);
+      return found ? Number(found[1]) : null;
+    } catch { return null; }
+  };
+  for (const m of modified.filter((a) => a.managed && /yad-gate-sync\.ya?ml$/.test(a.item))) {
+    const kept = pinMajorOf(m.managed.dest);
+    const ships = pinMajorOf(m.managed.src);
+    if (kept === null || ships === null || kept === ships) continue;
+    warn(`${m.scope}/${m.item} trusts only yadflow ${kept}.x pins, but this release's fragment trusts ${ships}.x — kept as it is, CI will skip the new version stamp and run yadflow@${kept}`);
+    hand(`re-apply your edit on top of the new fragment, or replace it with \`yad update --overwrite-local\` (your copy is saved beside it as ${path.basename(m.managed.dest)}${BACKUP_SUFFIX})`);
+  }
   if (modified.length && !overwriteLocal) {
     hand(`keep the edits (reported as \`modified\` on every check), or replace them with \`yad update --overwrite-local\` — each previous version is saved beside the file as <file>${BACKUP_SUFFIX}`);
   }
@@ -147,7 +170,7 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   if (!fix) {
     if (push) warn('--push has no effect without --fix (there is nothing applied to commit).');
     if (fixable.length || gaps.length) hand('run `yad check --fix` to reconcile (or `yad setup` for missing one-time setup).');
-    return { counts, gaps, applied: 0, modified: modified.length };
+    return { fix: false, counts, gaps, items: itemsOf(actions), applied: 0, modified: modified.length, commits: [] };
   }
 
   // --- apply --- (collect the applied actions so --push can stage each repo's exact allowlist) ---
@@ -187,9 +210,12 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   if (gaps.length) hand('one-time setup still missing — run `yad setup`.');
 
   // --- publish: commit each repo's applied changes and push directly to its default branch ---
+  // Each repo's `{ label, committed, pushed }`, for the --json answer (E1): a push that failed after a
+  // commit landed is said per repo.
+  let commits = [];
   if (push) {
     preflightGuardReadiness(root);
-    const hub = readJSON(path.join(root, PROJECT_FILES.hubConfig), {});
+    const hub = readJSON(productConfigPath(root), {});
     const defByRoot = new Map([[root, hub?.default_branch]]);
     const platformByRoot = new Map([[root, hub?.platform]]);
     for (const repo of registry.repos) {
@@ -197,7 +223,7 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
       defByRoot.set(repoRoot, repo.default_branch);
       platformByRoot.set(repoRoot, repo.platform);
     }
-    commitUpdates(root, groupByRoot(appliedActions), {
+    commits = commitUpdates(root, groupByRoot(appliedActions), {
       push: true, allowBranch,
       defaultBranchFor: (r) => defByRoot.get(r),
       // GitLab's yad-update-guard is an includable fragment: unlike a GitHub workflow it does nothing
@@ -211,5 +237,5 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
       },
     });
   }
-  return { counts, gaps, applied, modified: modified.length };
+  return { fix: true, counts, gaps, items: itemsOf(actions), applied, modified: modified.length, commits };
 }

package/cli/repo-publish.mjs

@@ -1,26 +1,26 @@
 // `yad repo refresh --push` — after a repack + registry stamp, commit the connected-repo code-context
 // (the tracked `code-map.md` per repo + the registry `.sdlc/repos.json`) and push it straight to the
-// hub's default branch, so a code-map refresh "just lands" for teammates / CI / `yad status` on other
+// Product's default branch, so a code-map refresh "just lands" for teammates / CI / `yad status` on other
 // machines instead of leaving a dirty tree for someone to hand-commit. This is the code-context
 // analogue of `yad checkpoint` (cli/checkpoint.mjs) and reuses its default-branch commit machinery.
 //
 // Invariants (shared with checkpoint):
 //   1. Commit an EXPLICIT allowlist via `git commit -- <paths>` (--only) — the tracked code-maps, the
-//      registry, and (only when its change is the managed pack-ignore block alone) the hub `.gitignore`.
+//      registry, and (only when its change is the managed pack-ignore block alone) the Product `.gitignore`.
 //      NEVER `git add -A` and NEVER a whole-index `git reset`: both would mutate unrelated staged work.
 //      The repomix pack.md is gitignored (setup + publish scaffold the ignore via ensurePackIgnored) and
 //      never committed as content. A pack committed BEFORE that ignore existed is self-healed here: its
 //      on-disk file is held aside across the --only commit so the deletion is recorded (the regenerable
 //      cache is restored right after), clearing the stranded working tree — see the commit block below.
-//   2. Commit ONLY on the hub's default branch (unless --allow-branch), so the `[skip ci]` audit
+//   2. Commit ONLY on the Product's default branch (unless --allow-branch), so the `[skip ci]` audit
 //      commit never enters a PR's base..HEAD range where it would strand required checks.
 import fs from 'node:fs';
 import path from 'node:path';
 import { c, ok, info, fail, hand, exists, pushWithRebase } from './lib.mjs';
-import { PROJECT_FILES } from './manifest.mjs';
-import { loadHub } from './gate.mjs';
-import { resolveCommitterLogin } from './platform.mjs';
-import { hubGit, resolveDefaultBranch, guardDefaultBranch, preflightGuardReadiness } from './hubcommit.mjs';
+import { PROJECT_FILES , productConfigPath } from './manifest.mjs';
+import { loadProduct } from './gate.mjs';
+import { platformLogin } from './platform.mjs';
+import { productGit, resolveDefaultBranch, guardDefaultBranch, preflightGuardReadiness } from './hubcommit.mjs';
 import { ensurePackIgnored, PACK_IGNORE_BLOCK } from './setup.mjs';
 import { checkpointAuthor } from './checkpoint.mjs';
 
@@ -51,7 +51,7 @@ export function codeMapPathspecs(root, registry = { repos: [] }, name = null) {
 }
 
 // PURE — each registered repo's on-disk pack path (scoped by `name` like codeMapPathspecs). These are
-// UNTRACK candidates, not content to stage: the pack is gitignored, but a hub that committed it before
+// UNTRACK candidates, not content to stage: the pack is gitignored, but a Product that committed it before
 // the ignore existed would otherwise strand a dirty pack on every refresh. publishCodeContext keeps only
 // the still-tracked ones and records their removal in the audit commit (see the self-heal block there).
 export function packPathspecs(root, registry = { repos: [] }, name = null) {
@@ -65,11 +65,11 @@ export function packPathspecs(root, registry = { repos: [] }, name = null) {
 }
 
 // True iff committing `.gitignore` would carry ONLY the managed pack-ignore block (comments + glob) and
-// nothing else. Guards invariant 1: a hub whose `.gitignore` also has unrelated uncommitted edits must
+// nothing else. Guards invariant 1: a Product whose `.gitignore` also has unrelated uncommitted edits must
 // keep them OUT of the `[skip ci]` audit commit. The publish commit is `git commit -- <paths>` (--only,
 // reads the WORKING TREE), so this compares the working tree — an untracked `.gitignore` must be wholly
 // managed; a tracked one must differ from HEAD by the managed block alone (added, nothing removed).
-// `git` is a hubGit-style accessor; `root` is the hub root. Mirrors checkpoint's stagedStoryIsStatusOnly.
+// `git` is a productGit-style accessor; `root` is the Product root. Mirrors checkpoint's stagedStoryIsStatusOnly.
 export function ignoreChangeIsManagedOnly(git, root) {
   const gi = path.join(root, '.gitignore');
   if (!fs.existsSync(gi)) return false;
@@ -121,7 +121,7 @@ export function summarizeCodeContext(files = []) {
   return { label, basenames };
 }
 
-// PURE — the audit-trail commit message. Subject passes the hub commit-message gate (valid type
+// PURE — the audit-trail commit message. Subject passes the Product commit-message gate (valid type
 // `chore`, scope `hub`, non-empty description, no trailing period). No Task trailer and no
 // Co-Authored-By: this is human-owned machine state, not an authored code change. `[skip ci]` mirrors
 // `yad checkpoint` — it lands on the default branch and needs no PR gate suite. `label`/`author` are
@@ -132,19 +132,19 @@ export function buildCodeMapMessage({ label, author, basenames = [] }) {
   return body ? `${subject}\n\n${body}` : subject;
 }
 
-// Commit the tracked code-context (and, with push, push it) on the hub's default branch. Mirrors
+// Commit the tracked code-context (and, with push, push it) on the Product's default branch. Mirrors
 // `runCheckpoint`. Never throws; sets process.exitCode on a hard error so the CLI reports failure.
 export async function publishCodeContext(root, { push = false, allowBranch = false, name = null } = {}) {
   if (!exists(path.join(root, '.git'))) { fail('not a git repo'); process.exitCode = 1; return; }
-  if (!exists(path.join(root, PROJECT_FILES.hubConfig))) {
-    fail('no .sdlc/hub.json — --push publishes the hub code-context; run it from the product hub');
+  if (!exists(productConfigPath(root))) {
+    fail('no .sdlc/hub.json — --push publishes the Product code-context; run it from the Product');
     process.exitCode = 1;
     return;
   }
 
-  const { hub, repos } = loadHub(root);
+  const { hub, repos } = loadProduct(root);
   const registry = { repos: repos || [] };
-  const git = hubGit(root);
+  const git = productGit(root);
 
   const branch = git('rev-parse', '--abbrev-ref', 'HEAD').stdout;
   const defaultBranch = resolveDefaultBranch(git, hub);
@@ -161,8 +161,8 @@ export async function publishCodeContext(root, { push = false, allowBranch = fal
   }
 
   // Make the "pack is gitignored" assumption true (idempotent; packRepo also does this on refresh) so a
-  // hub whose pack was tracked before the ignore existed stops stranding a dirty tree. Publish `.gitignore`
-  // ONLY when the change is the managed pack-ignore block alone (invariant 1) — a hub whose `.gitignore`
+  // Product whose pack was tracked before the ignore existed stops stranding a dirty tree. Publish `.gitignore`
+  // ONLY when the change is the managed pack-ignore block alone (invariant 1) — a Product whose `.gitignore`
   // also carries unrelated uncommitted edits keeps them OUT of this audit commit; the pack is still ignored
   // on disk and the human commits their own `.gitignore` edits through their own change. When we do carry
   // it, `git add` makes an untracked `.gitignore` known so the --only commit can include it.
@@ -204,17 +204,16 @@ export async function publishCodeContext(root, { push = false, allowBranch = fal
     const ahead = rev.ok ? (Number(rev.stdout) || 0) : 1; // no upstream ref yet -> attempt the push
     if (!ahead) { info('code-context unchanged and already published — nothing to do'); return; }
     info(`code-context unchanged — pushing ${ahead} already-committed change(s) not yet on origin/${branch}`);
-    pushHead();
-    return;
+    return { message: null, committed: false, pushed: pushHead() };
   }
 
   // Only relevant when we are about to push a commit straight to the default branch: warn (never block)
-  // if signing/allowlisting would make the yad-update-guard reject it. Gated on `push` and deferred to
+  // if unsigned commits would make the yad-update-guard reject it. Gated on `push` and deferred to
   // here so it isn't noise on a guard-refused branch or a nothing-to-commit run.
   if (push) preflightGuardReadiness(root);
 
   const { label, basenames } = summarizeCodeContext(fileset);
-  const author = checkpointAuthor(resolveCommitterLogin(root, hub?.roster || []), git('config', 'user.name').stdout);
+  const author = checkpointAuthor(platformLogin(root, hub?.platform), git('config', 'user.name').stdout);
   const message = buildCodeMapMessage({ label, author, basenames });
 
   // Untrack the packs by holding their bytes and removing the files across the --only commit, then
@@ -232,14 +231,13 @@ export async function publishCodeContext(root, { push = false, allowBranch = fal
       git('reset', '-q', '--', ...pathspecs, ...ignoreSpec); // unstage only OUR allowlist for a clean retry
       fail(`git commit failed — ${cm.stderr.split('\n')[0] || cm.code}`);
       process.exitCode = 1;
-      return { message };
+      return { message, committed: false, pushed: false };
     }
   } finally {
     for (const h of held) if (!fs.existsSync(h.abs)) fs.writeFileSync(h.abs, h.buf);
   }
   ok(`published ${fileset.length} file(s): ${c.dim(label)}`);
 
-  if (!push) return { message };
-  pushHead();
-  return { message };
+  if (!push) return { message, committed: true, pushed: false };
+  return { message, committed: true, pushed: pushHead() };
 }

package/cli/repo.mjs

@@ -38,55 +38,64 @@ function defaultBranch(cwd, repo) {
 
 export async function runRepo(root, { action = 'list', name, today, push = false, allowBranch = false } = {}) {
   const { regPath, registry } = load(root);
-  if (!registry.repos.length) { warn('no repos registered (.sdlc/repos.json) — run `yad setup`'); return { repos: 0 }; }
+  if (!registry.repos.length) { warn('no repos registered (.sdlc/repos.json) — run `yad setup`'); return { action, repos: [] }; }
 
   if (action === 'list') {
     log(c.bold('\nconnected repos'));
     let staleCount = 0;
+    const rows = [];   // the --json answer (E1): each repo, as the list reads it
     for (const repo of registry.repos) {
-      const { stale, unknown, neverPacked } = staleness(root, repo);
+      const { head, stale, unknown, neverPacked } = staleness(root, repo);
+      rows.push({ name: repo.name ?? null, path: repo.path ?? null, head: head || null, syncedHead: repo.syncedHead ?? null,
+        state: unknown ? 'unreadable' : neverPacked ? 'no-pack' : stale ? 'stale' : 'fresh' });
       if (unknown) { warn(`${repo.name} ${c.dim(`(${repo.path})`)} — HEAD unreadable`); continue; }
       if (neverPacked) { staleCount++; warn(`${repo.name} ${c.dim(`(${repo.path})`)} — ${c.yellow('no code-context pack yet')} (registered without one)`); }
       else if (stale) { staleCount++; warn(`${repo.name} ${c.dim(`(${repo.path})`)} — ${c.yellow('stale')} (HEAD moved since last pack)`); }
       else ok(`${repo.name} ${c.dim('— fresh')}`);
     }
     if (staleCount) hand(`refresh with \`yad repo refresh${registry.repos.length > 1 ? ' <name>' : ''}\` (or \`yad repo refresh\` for all)`);
-    return { repos: registry.repos.length, stale: staleCount };
+    return { action, repos: rows, stale: staleCount };
   }
 
   if (action === 'refresh') {
     const targets = name ? registry.repos.filter((r) => r.name === name) : registry.repos;
-    if (name && !targets.length) { fail(`unknown repo: ${name}`); process.exitCode = 1; return { refreshed: 0 }; }
+    if (name && !targets.length) { fail(`unknown repo: ${name}`); process.exitCode = 1; return { action, refreshed: 0, repos: [], published: null }; }
     let refreshed = 0;
+    let published = null;
+    const rows = [];
     for (const repo of targets) {
       const { head, unknown } = staleness(root, repo);
-      if (unknown) { warn(`${repo.name}: HEAD unreadable — skipped`); continue; }
+      if (unknown) { warn(`${repo.name}: HEAD unreadable — skipped`); rows.push({ name: repo.name ?? null, refreshed: false, head: null }); continue; }
       log(`  ${c.bold(repo.name)}`);
-      if (packRepo(root, repo)) {
+      const packed = !!packRepo(root, repo);
+      if (packed) {
         repo.syncedHead = head;
         if (today) repo.lastSyncedAt = today;   // always stamp when a date is supplied (the CLI passes today)
         refreshed++;
       }
+      rows.push({ name: repo.name ?? null, refreshed: packed, head: head || null });
     }
     writeJSON(regPath, registry);
     refreshed ? ok(`refreshed ${refreshed} repo(s)`) : info('nothing refreshed');
     if (push) {
       // Publish whatever tracked code-context now differs (the AI-regenerated code-maps + the stamped
-      // registry) straight to the hub's default branch as one audit-trail commit. The pack itself is
+      // registry) straight to the Product's default branch as one audit-trail commit. The pack itself is
       // gitignored (packRepo scaffolds the ignore; publish self-heals a pre-ignore tracked pack); the
       // code-map is regenerated by the AI (yad-connect-repos) — run that first if a repo's map is stale,
       // then `yad repo refresh --push` lands it.
-      await publishCodeContext(root, { push: true, allowBranch, name });
+      published = (await publishCodeContext(root, { push: true, allowBranch, name })) ?? null;
     } else {
-      hand('regenerate the code-map in Claude Code (yad-connect-repos) — the pack is cached, the map is the AI step');
-      hand('then publish it to the hub default branch with `yad repo refresh --push`');
+      hand('regenerate the code-map in your AI agent (yad-connect-repos) — the pack is cached, the map is the AI step');
+      hand('then publish it to the Product default branch with `yad repo refresh --push`');
     }
-    return { refreshed };
+    // `published`: what `--push` did (`{ message, committed, pushed }`), or null when it committed nothing
+    // — nothing to publish, or a refusal, which the answer's `error` then names.
+    return { action, refreshed, repos: rows, published };
   }
 
   if (action === 'sync') {
     const targets = name ? registry.repos.filter((r) => r.name === name) : registry.repos;
-    if (name && !targets.length) { fail(`unknown repo: ${name}`); process.exitCode = 1; return { synced: 0 }; }
+    if (name && !targets.length) { fail(`unknown repo: ${name}`); process.exitCode = 1; return { action, synced: 0, skipped: 0, repos: [] }; }
     log(c.bold('\nsync connected repos'));
     let synced = 0, skipped = 0;
     for (const repo of targets) {
@@ -118,10 +127,10 @@ export async function runRepo(root, { action = 'list', name, today, push = false
     const staleCount = registry.repos.filter((r) => staleness(root, r).stale).length;
     info(`synced ${synced}, skipped ${skipped}`);
     if (staleCount) hand(`${staleCount} repo(s) now have a stale code-context pack — \`yad repo refresh\` to repack`);
-    return { synced, skipped, stale: staleCount };
+    return { action, synced, skipped, stale: staleCount };
   }
 
   fail(`unknown repo action: ${action} (list | refresh | sync)`);
   process.exitCode = 1;
-  return {};
+  return { action };
 }

package/cli/report.mjs

@@ -4,15 +4,14 @@
 // PRIVACY IS THE POINT: the issue posts to a PUBLIC repo, so this module is allowlist-first. It
 // assembles ONLY a known-safe set of fields (version, node/os, tool booleans, platform enum, error
 // code/hint, a path-scrubbed message, and command + flag NAMES) and actively strips everything else —
-// no absolute paths, hostnames, git URLs, repo names, roster logins/emails, epic/story IDs, branch
+// no absolute paths, hostnames, git URLs, repo names, logins/emails, epic/story IDs, branch
 // names, or flag values ever leave the machine. The user sees the exact payload and confirms before
 // anything is posted. See memory: no-private-data-in-reports.
-import path from 'node:path';
-import { c, log, info, ok, warn, note, ask, askYesNo, has, readJSON, run } from './lib.mjs';
-import { VERSION, UPSTREAM_REPO, PROJECT_FILES } from './manifest.mjs';
+import { c, log, info, ok, warn, note, ask, askYesNo, has, readJSON, run, inJSON } from './lib.mjs';
+import { VERSION, UPSTREAM_REPO , productConfigPath } from './manifest.mjs';
 import { createIssue, searchIssues, issueUrl, platformAuthed } from './platform.mjs';
 
-// The upstream lives on GitHub — file there regardless of the user's own hub platform.
+// The upstream lives on GitHub — file there regardless of the user's own Product platform.
 const UPSTREAM_PLATFORM = 'github';
 const PLACEHOLDER = '‹redacted›';
 
@@ -39,13 +38,16 @@ export function scrub(s = '') {
 }
 
 // The verbs `yad` understands (top-level commands + their sub-actions). Anything NOT in this set —
-// roster logins, repo names, roles, epic IDs, filenames, and every flag VALUE — is dropped, so the
+// logins, repo names, roles, epic IDs, filenames, and every flag VALUE — is dropped, so the
 // reported command carries only structure, never data.
 const SAFE_VERBS = new Set([
   'setup', 'check', 'update', 'doctor', 'report', 'sync-status', 'next', 'gate', 'review', 'commit',
+  // `roster` (and its `add`/`grant`/`revoke`/`remove`) stays: the command was removed in E62 but still
+  // answers with a notice, and a report about that notice must keep its structure.
   'open-pr', 'ship', 'repo', 'roster', 'docs', 'thread', 'reconcile',
   'open', 'sync', 'comments', 'status', 'walkthrough', 'trailer', 'ci', 'context', 'chat', 'cards',
   'nudge', 'list', 'add', 'grant', 'revoke', 'remove', 'build', 'deploy', 'refresh', 'wire',
+  'risk-map', 'draft', 'codeowners',
 ]);
 
 // Reduce an argv to a safe command line: the leading verb chain (at most `command subcommand`, and
@@ -72,8 +74,8 @@ export function sanitizeArgv(argv = []) {
 // Build the safe, postable context — the ONLY data that can reach the issue. Reads doctor for tool
 // state but keeps just the booleans, never the raw checks (which carry names + paths).
 export function sanitizeContext(dir, { error = null, argv = process.argv.slice(2) } = {}) {
-  const hub = readJSON(path.join(dir, PROJECT_FILES.hubConfig), null);
-  const platform = hub && ['github', 'gitlab'].includes(hub.platform) ? hub.platform : 'file-only';
+  const hub = readJSON(productConfigPath(dir), null);
+  const platform = hub && ['github', 'gitlab'].includes(hub.platform) ? hub.platform : 'local';
   // Derive tool auth from doctor's checks without keeping any check text.
   const toolState = (cli, p) => (has(cli) ? (platformAuthed(p) ? 'present + authenticated' : 'present, not authenticated') : 'not installed');
   const ctx = {
@@ -82,7 +84,7 @@ export function sanitizeContext(dir, { error = null, argv = process.argv.slice(2
     os: process.platform,
     git: has('git') ? 'present' : 'not found',
     gh: toolState('gh', 'github'),
-    // The hub CLI's auth is a useful diagnostic for a GitLab user (issues still file to GitHub upstream).
+    // The Product CLI's auth is a useful diagnostic for a GitLab user (issues still file to GitHub upstream).
     ...(platform === 'gitlab' ? { glab: toolState('glab', 'gitlab') } : {}),
     platform,
     command: sanitizeArgv(argv) || '(none)',
@@ -154,7 +156,8 @@ export async function runReport(dir, opts = {}) {
     opener = openUrl,
     authed = () => platformAuthed(UPSTREAM_PLATFORM),
     argv = process.argv.slice(2),
-    interactive = !process.env.SDLC_NONINTERACTIVE,
+    // A --json run never prompts, and so never posts (E1): it answers with the payload and the prefilled URL.
+    interactive = !process.env.SDLC_NONINTERACTIVE && !inJSON(),
   } = opts;
 
   try {
@@ -174,15 +177,17 @@ export async function runReport(dir, opts = {}) {
     // Dedup — search open issues by the error code (or the first summary word). Advisory: a failed
     // search just skips this step, it never blocks filing.
     const query = ctx.error?.code || (summary.split(/\s+/)[0] || '').replace(/[^\w-]/g, '');
+    let related = [];
     if (query) {
       const { ok: searchedOk, matches } = searcher(UPSTREAM_PLATFORM, UPSTREAM_REPO, `${query} in:title`);
+      if (searchedOk) related = matches.map((m) => ({ number: m.number, title: m.title, url: m.url }));
       if (searchedOk && matches.length) {
         log(c.bold(`\nFound ${matches.length} possibly-related open issue(s):`));
         for (const m of matches) info(`#${m.number} — ${m.title}  ${c.dim(m.url)}`);
         if (interactive && await prompter('Open an existing issue instead of filing a new one?', true)) {
           opener(matches[0].url);
           log(`\n  → ${c.cyan(matches[0].url)}`);
-          return { filed: false, url: matches[0].url, deduped: true };
+          return { filed: false, url: matches[0].url, deduped: true, title, body, labels, related };
         }
       }
     }
@@ -201,7 +206,8 @@ export async function runReport(dir, opts = {}) {
       const url = issueUrl(UPSTREAM_PLATFORM, UPSTREAM_REPO, { title, body, labels });
       note(interactive ? 'Not posted. You can file it yourself here (prefilled):' : 'Non-interactive — not posted. File it here (prefilled):');
       log(`  → ${c.cyan(url)}`);
-      return { filed: false, url };
+      // The payload exactly as it would be posted, for a --json caller to show or file itself.
+      return { filed: false, url, title, body, labels, related };
     }
 
     // File directly when the CLI is authenticated; otherwise fall back to the prefilled URL.
@@ -209,7 +215,7 @@ export async function runReport(dir, opts = {}) {
       const r = filer(UPSTREAM_PLATFORM, UPSTREAM_REPO, { title, body, labels });
       if (r.ok) {
         ok(`Issue filed: ${c.cyan(r.url)}`);
-        return { filed: true, url: r.url };
+        return { filed: true, url: r.url, title, body, labels, related };
       }
       warn(`Could not file automatically: ${r.reason || 'unknown error'}`);
     } else {
@@ -218,10 +224,10 @@ export async function runReport(dir, opts = {}) {
     const url = issueUrl(UPSTREAM_PLATFORM, UPSTREAM_REPO, { title, body, labels });
     opener(url);
     log(`  → ${c.cyan(url)}`);
-    return { filed: false, url };
+    return { filed: false, url, title, body, labels, related };
   } catch (e) {
     // Reporting itself must never crash the CLI.
     note(`could not complete the report (${e?.message || e}) — please file manually at https://github.com/${UPSTREAM_REPO}/issues`);
-    return { filed: false, url: null, failed: true };
+    return { filed: false, url: null, title: null, body: null, labels: [], related: [], failed: true };
   }
 }

package/cli/review.mjs

@@ -1,13 +1,13 @@
-// `yad review trailer|context|nudge|reconcile` — the BACK-HALF Review Companion + bridge for code
-// PR/MRs (the analogue of `yad gate …` for the front half). The fun process (trailer/cards/chat/nudge)
-// makes the engineer review easy and visible; the bridge process (reconcile) maps the code PR's review
+// `yad review trailer|context|nudge|reconcile` — the Build Review Companion + bridge for code
+// PR/MRs (the analogue of `yad gate …` for Shape). The fun process (trailer/cards/chat/nudge)
+// makes the engineer review easy and visible; the bridge to code PR/MRs (reconcile) maps the code PR's review
 // state — including the engagement signal — into the build ledger (build-log.json) at merge.
 //
 // The CLI never calls an LLM: the skill (yad-review-companion / yad-engineer-review) generates the
 // trailer/cards/chat text and posts it via these primitives, all to the PLATFORM (never a ledger file).
 import path from 'node:path';
-import { log, ok, info, warn, fail, note, run, readJSON } from './lib.mjs';
-import { PROJECT_FILES } from './manifest.mjs';
+import { log, ok, info, warn, fail, note, run, readJSON, emitJSON, refuse, inJSON, collectWarning } from './lib.mjs';
+import { PROJECT_FILES , productConfigPath } from './manifest.mjs';
 import { updateShip } from './ledger.mjs';
 import { epicRoot } from './epic-state.mjs';
 import {
@@ -19,7 +19,7 @@ import { sequenceDiff } from './walkthrough.mjs';
 
 const NUDGE_CMD = 'yad review chat';
 
-// Resolve the target code repo: --repo <name> from the registry (platform + path + roles), else cwd.
+// Resolve the target code repo: --repo <name> from the registry (platform + path), else cwd.
 // An explicit --repo that is NOT in the registry is an error — never silently fall through to cwd (that
 // would operate on the wrong repo). Returns { error } in that case for the caller to surface.
 function resolveRepo(root, { repo, dir }) {
@@ -35,10 +35,10 @@ function resolveRepo(root, { repo, dir }) {
 function platformOf(root, repoRoot, meta) {
   if (meta?.platform) return meta.platform;
   const remote = run('git', ['remote', 'get-url', 'origin'], { cwd: repoRoot }).stdout;
-  return detectPlatform(remote) || readJSON(path.join(root, PROJECT_FILES.hubConfig), {}).platform || null;
+  return detectPlatform(remote) || readJSON(productConfigPath(root), {}).platform || null;
 }
 
-// Build (but don't print) the back-half grounding bundle. Shared by `context` and `walkthrough` so the
+// Assemble (but don't print) the Build grounding bundle. Shared by `context` and `walkthrough` so the
 // pair walkthrough adds an ordered stop-list on top of the exact same grounding the companion uses.
 // Returns { error } on a bad --repo, else { bundle, repoRoot, base }.
 function contextBundle(root, { repo, dir, pr, runner = run } = {}) {
@@ -73,8 +73,8 @@ function contextBundle(root, { repo, dir, pr, runner = run } = {}) {
 // the trailer / cards and run the chat over the CODE diff (grounded in the repo code-map + the PR).
 export async function reviewContext(root, { repo, dir, pr, runner = run } = {}) {
   const r = contextBundle(root, { repo, dir, pr, runner });
-  if (r.error) { fail(r.error); process.exitCode = 1; return; }
-  log(JSON.stringify(r.bundle, null, 2));
+  if (r.error) { refuse(r.error, null, { json: true }); return; }
+  emitJSON(r.bundle);
   return r.bundle;
 }
 
@@ -84,15 +84,15 @@ export async function reviewContext(root, { repo, dir, pr, runner = run } = {})
 // the per-stop briefing + Socratic question, and runs the two-way session. No LLM here, no ledger write.
 export async function reviewWalkthrough(root, { repo, dir, pr, runner = run } = {}) {
   const r = contextBundle(root, { repo, dir, pr, runner });
-  if (r.error) { fail(r.error); process.exitCode = 1; return; }
+  if (r.error) { refuse(r.error, null, { json: true }); return; }
   const { bundle, repoRoot, base } = r;
   const diff = runner('git', ['-C', repoRoot, 'diff', `${base}...HEAD`]);
   // Diagnostics go to STDERR so STDOUT stays pure JSON (the skill / e2e parse it). The empty `stops: []`
   // in the bundle already signals "nothing to walk".
-  if (!diff.ok) note(`could not read the diff (${base}...HEAD) in ${repoRoot} — is the branch pushed and the base correct?`);
+  if (!diff.ok) { const w = `could not read the diff (${base}...HEAD) in ${repoRoot} — is the branch pushed and the base correct?`; collectWarning(w); note(w); }
   const stops = sequenceDiff(diff.ok ? diff.stdout : '', { contractPath: bundle.contract });
   const out = { ...bundle, stops };
-  log(JSON.stringify(out, null, 2));
+  emitJSON(out);
   if (!stops.length) note('no stops — the diff is empty (nothing to walk through)');
   return out;
 }
@@ -112,7 +112,7 @@ export async function reviewTrailer(root, { repo, dir, pr, body, getBody = getPr
   const r = editBody(platform, pr, upsertTrailerBlock(cur.body, String(body).trim()), { cwd: repoRoot });
   if (!r.ok) { fail(`could not update PR #${pr}: ${r.reason || 'unknown'}`); process.exitCode = 1; return; }
   ok(`trailer posted to ${platform === 'gitlab' ? 'MR' : 'PR'} #${pr}`);
-  return { number: pr };
+  return { number: pr, posted: true };
 }
 
 // `yad review nudge --repo <r> --pr <n>` — friendly public @-mention on a bare approve (engagement none)
@@ -125,7 +125,7 @@ export async function reviewNudge(root, { repo, dir, pr, reader = readPr, poster
   const platform = platformOf(root, repoRoot, meta);
   if (!platform) { fail('could not detect platform (github/gitlab)'); process.exitCode = 1; return; }
   const pull = reader(platform, pr, { cwd: repoRoot });
-  if (!pull.ok) { warn(`could not read PR #${pr}: ${pull.reason}`); process.exitCode = 1; return; }
+  if (!pull.ok) { fail(`could not read PR #${pr}: ${pull.reason}`); process.exitCode = 1; return; }
   let nudged = 0;
   for (const rv of pull.reviews) {
     if (rv.state !== 'APPROVED' || parseEngagement(rv.body) === 'verified' || !rv.login) continue;
@@ -136,7 +136,7 @@ export async function reviewNudge(root, { repo, dir, pr, reader = readPr, poster
   return { nudged };
 }
 
-// `yad review reconcile --epic <id> --repo <r> --pr <n>` — the back-half BRIDGE: read the code PR's
+// `yad review reconcile --epic <id> --repo <r> --pr <n>` — the Build BRIDGE: read the code PR's
 // approvals (with the engagement signal) and stamp them onto the matching build-log.json ship record,
 // so the build ledger reflects who actually engaged. The first CLI to write build-log.json. Matches the
 // ship record by its `pr` field (url or number); if none exists yet, prints the engineer_review block
@@ -149,22 +149,18 @@ export async function reviewReconcile(root, { epic, repo, dir, pr, reader = read
   const { repoRoot, meta } = rr;
   const platform = platformOf(root, repoRoot, meta);
   if (!platform) { fail('could not detect platform (github/gitlab)'); process.exitCode = 1; return; }
-  const hub = readJSON(path.join(root, PROJECT_FILES.hubConfig), { roster: [] });
-  const registry = readJSON(path.join(root, PROJECT_FILES.reposRegistry), { repos: [] });
-  const domain = meta?.name ? [meta.name] : [];
   const pull = reader(platform, pr, { cwd: repoRoot });
   if (!pull.ok) { fail(`could not read PR #${pr}: ${pull.reason}`); process.exitCode = 1; return; }
 
-  // Map platform approvals → engineer_review entries, deduped by (approver, role, domain), carrying the
-  // engagement signal read from the approve body/note.
-  const recs = mapApprovers(pull.reviews, { roster: hub.roster || [], repos: registry.repos || [], touchedDomains: domain, headOid: pull.headOid });
+  // Map platform approvals → engineer_review entries, one per approving login (E62: no roster, so no
+  // role or domain to attach), carrying the engagement signal read from the approve body/note.
+  const recs = mapApprovers(pull.reviews, { headOid: pull.headOid });
   const seen = new Set();
   const engineerReview = [];
   for (const r of recs) {
-    const key = `${r.name}|${r.role}|${r.domain || ''}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    engineerReview.push({ approver: r.name, role: r.role, ...(r.domain ? { domain: r.domain } : {}), engagement: r.engagement === 'verified' ? 'verified' : 'none' });
+    if (seen.has(r.name)) continue;
+    seen.add(r.name);
+    engineerReview.push({ approver: r.name, engagement: r.engagement === 'verified' ? 'verified' : 'none' });
   }
 
   // Match by exact PR number — never substring (`--pr 5` must not match a ship recorded against #15).
@@ -177,7 +173,8 @@ export async function reviewReconcile(root, { epic, repo, dir, pr, reader = read
   );
   if (!res.found) {
     warn(`no build-log ship record matches PR #${pr} in ${epic} — attach this at ship time:`);
-    log(JSON.stringify({ engineer_review: engineerReview }, null, 2));
+    // The block to attach, for a person to copy. Under --json the answer carries it as `engineerReview`.
+    if (!inJSON()) log(`  ${JSON.stringify({ engineer_review: engineerReview })}`);
     return { engineerReview, written: false };
   }
   ok(`stamped engagement onto ${epic} ship ${res.ship.story || ''}${res.ship.task ? '/' + res.ship.task : ''} (PR #${pr})`);