yadflow 3.19.0-next.2 → 4.0.0-next.3

package/skills/yad-pr-template/references/risk-routing.md

@@ -1,8 +1,8 @@
 # Impact & Risk block and review routing
 
 The PR/MR template (Phase 3 build plan §D) carries an **Impact & Risk** block so every change states
-its blast radius before review, and so high-risk changes pull in the right reviewers automatically —
-reusing the escalation `yad-review-gate` already applies on the Shape gates.
+its blast radius before review, and so a high-risk change shows how many approvers it asks for —
+the same count `yad-review-gate` prints on the Shape gates.
 
 ## The Impact & Risk block
 
@@ -14,41 +14,114 @@ reusing the escalation `yad-review-gate` already applies on the Shape gates.
 - **Rollback plan:** <how to revert>
 ```
 
-- **Domains / repos touched** — the domains this change affects; these are the candidate domain owners
-  when the change escalates.
+- **Domains / repos touched** — the domains this change affects. When the count is raised,
+  `risk-route.sh` lists them as a hint for whom to ask. yadflow keeps no list of people, so no names come from it.
 - **Contract surface touched** — `yes` means the diff changes the shared contract surface. That path is
-  governed by `contract-check` (needs `Contract-Change: yes` + a re-locked contract) AND it escalates
-  the review (contract is a `yad-review-gate` risk tag).
+  governed by `contract-check` (needs `Contract-Change: yes` + a re-locked contract) AND it raises the
+  approver count (contract is a `yad-review-gate` risk tag).
 - **Risk level** — `low | medium | high`. The author's assessment of blast radius.
 - **Rollback plan** — how to revert safely.
 
-## Routing rule (reuses the gate's escalation)
+## Routing rule (reuses the gate's count)
 
-| Condition | Required reviewers |
-|-----------|--------------------|
-| `low` / `medium`, no sensitive surface | **base rule:** owner + 1 reviewer |
-| `high`, OR a touched contract/auth/payments surface | base rule **plus one domain-owner approval per touched domain** |
+The count is `base 1 + risk step`:
 
-This is exactly `yad-review-gate`'s rule (`references/gating.md`): the base rule is owner + 1
-reviewer; escalation adds a domain-owner per touched domain. The PR template applies the same logic at
-the code-review boundary so a risky PR cannot be approved by just any two people. The **approvals are
-recorded by the engineer review (Step E) through `yad-review-gate`** — the template and `risk-route.sh`
-only *route* (advisory); they never approve or merge.
+| Condition | Risk step | Approvers |
+|-----------|-----------|-----------|
+| `low` / `medium`, no contract surface | +0 | 1 (the base) |
+| `high` | +1 | 2 |
+| contract surface touched | +2 | 3 |
+
+`high` risk and a touched contract surface together take the **larger** step (contract, +2), never the
+sum. Approvers are counted as distinct people, and the base approver should not be the author.
+
+**The count is reported, not enforced, on a code PR.** Branch protection holds the merge — at least 1
+approval (GitHub blocks self-approval; GitLab only if its settings do). The risk step is **advisory**
+here. The capacity cap (roadmap E72) caps a count at the active people less one. It is reported, not
+enforced, on the Shape gates for now, and on the Build half it stays reported even once the Shape cap
+is enforced: `yad open-pr` prints the count capped by the active people, while `risk-route.sh` cannot cap, because a code repo's CI has no Product to count people
+from. There are no roles: no owner, no reviewer, no
+domain owner. This is `yad-review-gate`'s rule (`references/gating.md`) applied at the code-review
+boundary. The **approvals are recorded by the engineer review (Step E) through `yad-review-gate`** — the
+template and `risk-route.sh` only *route* (advisory); they never approve or merge.
+
+**The risk map counts too (E66).** A code repo's `.sdlc/risk-map` (E65) gives each directory a level —
+`high`, `medium` or `low`. A change that touches a `high` directory adds the high step (+1), the same
+step a body saying `Risk level: high` adds. The rules:
+
+- The map is read from the **base branch**, never the PR's own copy, so a PR cannot lower its count by
+  editing or deleting the map.
+- The **larger** step wins. A body saying `low` on a change to a `high` directory still counts +1, and
+  the output says the two disagree. A body saying `high` still counts +1 when the map says `low`.
+- A `guessed` level counts as a `confirmed` one does: a level only raises the count, never lowers it.
+- `medium` is printed and adds nothing. An `unset` line, or a directory no line covers, adds nothing.
+- A deleted or moved file counts where it was.
+- If the map cannot be read (no base, a shallow clone, a newer map version, or a `checks/risk-map-check.sh`
+  older than this count, which `yad update` refreshes), the output says so and counts the body alone. It
+  never guesses a level.
 
 ## risk-route.sh
 
-`bash checks/risk-route.sh <pr-description-file>` parses the Impact & Risk block and prints the required
-reviewers. Example (high risk, two domains):
+`bash checks/risk-route.sh <pr-description-file> [<base>]` parses the Impact & Risk block, asks
+`checks/risk-map-check.sh --level` for the level the change takes from the base branch's risk map, and
+prints the approver count. **Run it inside the code repo, on the PR's branch.** On the base branch itself
+the change is empty, and it says so. `<base>` defaults the way the checks resolve it (the configured
+`default_branch`, then `origin/HEAD`, then `origin/main`). Example (high risk, two domains):
 
 ```
 Risk level: high
 Contract surface touched: no
 Domains touched: backend, mobile
-ROUTE: ESCALATED (risk: high) -> owner + 1 reviewer PLUS one domain-owner approval per touched domain
-       (same escalation as yad-review-gate). Required domain owners:
-  - domain-owner: backend
-  - domain-owner: mobile
+Risk map (origin/main): low — nothing this change touches is high
+ROUTE: 2 approvers = base 1 + high risk 1 (risk: high)
+       Branch protection (when configured) holds the merge, not this count: at least 1 approval (GitHub blocks self-approval; GitLab only if its settings do).
+       The risk step is advisory, and not capped here — `yad open-pr` shows the count capped by the active people.
+       Ask reviewers who know the touched domains:
+  - backend
+  - mobile
+```
+
+With a touched contract surface the line reads `ROUTE: 3 approvers = base 1 + contract risk 2 (contract
+surface touched)`. With neither it reads `ROUTE: 1 approver = base 1 (no risk step).` When the map raises
+a body that says `low`:
+
 ```
+Risk map (origin/main): high — src/payments/ (guessed)
+  worked there in the last 30 days: Alice (@alice)
+ROUTE: 2 approvers = base 1 + high risk 1 (high on the risk map: src/payments/ (guessed))
+       The body says Risk level: low, but the risk map on origin/main marks src/payments/ (guessed) high — the larger counts.
+       Branch protection (when configured) holds the merge, not this count: at least 1 approval (GitHub blocks self-approval; GitLab only if its settings do).
+       The risk step is advisory, and not capped here — `yad open-pr` shows the count capped by the active people.
+       This change touches src/payments/ (guessed), so it asks for an approval from someone who has
+       committed there in the last 30 days (its own authors left out):
+  - Alice (@alice)
+       Ask reviewers who know the touched domains:
+  (Domains line not filled in — list each touched domain so the right reviewers can be asked.)
+```
+
+**Proven history (E67).** When a `high` directory is touched, the script also names the people who have
+committed there in the **last 30 days**, read from the base branch's history, with this change's own
+authors left out (an approval has to come from someone else). A robot is never listed. A person is shown
+as their git name, plus `(@login)` only when their commit address is a platform `noreply` one — yadflow
+prints no e-mail addresses. A name holding an `@` is shown as the bare login (`- @carol`), else as `a name
+that is an e-mail address` or `a name written like a login`, so a printed `@word` is always a real login. "Recent" is git's `--since`, which uses the **committer** date, so a rebased
+or squashed commit counts from when it landed. Work in a `low` directory *inside* a `high` one is not
+history for the `high` one: the deepest map line decides, and git applies that itself — one query per
+directory, excluding the listed directories below it, so no file name is ever read back out of git.
+
+When a change touches more than one `high` directory, the people are printed as ONE list: someone who
+has worked in any of them meets the ask, and the output does not say who worked where.
+
+Two answers are not a list of people, and both are said plainly:
+
+- `nobody else has committed there in the last 30 days` — the count stands on its own.
+- `who has worked there lately: not read — …` — a shallow clone, or git could not read the history. The
+  ask is unknown, never "nobody".
+
+The CI `risk-map` job prints the map's part on every PR as a `COUNT [risk-map]:` line. It does not read
+the body, so `risk-route.sh` is where the two meet. `yad open-pr` prints the same joined count once the
+PR is open, and leaves the body's level as the author wrote it.
 
-It is **advisory** — not a blocking gate. CI may run it to comment the required reviewers; the human
-review (Step E) still owns the merge.
+It is **advisory** — not a blocking gate, and not a CI job (the user's decision, 2026-09-18): the CI
+`risk-map` job prints the map's half, and the human review (Step E), which runs this script, owns the
+merge. No reviewers are requested automatically: ask them on the PR/MR itself.

package/skills/yad-pr-template/templates/checks/pr-template.sh

@@ -7,13 +7,15 @@
 #     requires `## Summary`, `## Impact & Risk`, `## Checklist`, and a filled `Risk level:` (low|medium|high).
 #   --profile hub — the Shape artifact-review template (templates/hub/<platform>/):
 #     requires `## Artifact under review`, `## Impact & Risk (front-half)` (or `(Shape)`), `## Checklist`, and a `Risk tags:` line.
-#     BUT only for review/EP-* head branches. Every other hub PR is a tooling/code change to the hub
+#     BUT only for review/EP-* head branches. Every other Product PR is a tooling/code change to the Product
 #     itself and uses the code task template instead; pass the head ref via --head so the gate knows
-#     which template to require. With no --head, the hub profile stays strict (artifact-review template).
+#     which template to require. With no --head, the Product profile stays strict (artifact-review template).
 #     Branch name is not enough on its own: a non-review head that actually changes Shape
 #     artifacts (epics/**) would otherwise slip past the review workflow with only the code template.
 #     Pass the PR's changed paths via --changed <file> (one path per line); when they touch epics/**
 #     on a non-review head the gate FAILS — artifact changes must go through a review/EP-* PR.
+#     Build the list with `git -c core.quotePath=false diff --no-renames --name-only`: without
+#     --no-renames a rename lists only its new path, and the removed artifact is never seen.
 # The body is passed as a FILE path (single positional arg); CI writes the event body to a temp file
 # (GitHub: github.event.pull_request.body; GitLab: $CI_MERGE_REQUEST_DESCRIPTION).
 set -euo pipefail
@@ -33,11 +35,32 @@ while [ $# -gt 0 ]; do
     *) ARGS+=("$1"); shift ;;
   esac
 done
-case "$PROFILE" in code|hub) ;; *) echo "FAIL [pr-template]: unknown --profile '$PROFILE' (code|hub)."; exit 1 ;; esac
+case "$PROFILE" in code|hub|product) ;; *) echo "FAIL [pr-template]: unknown --profile '$PROFILE' (code|hub|product)."; exit 1 ;; esac
+# `product` is the new name for the `hub` profile and BOTH are accepted.
+#
+# Not because the two sides update separately — they do not: this script and the workflow that passes
+# the flag are both in PRODUCT_WIRING (cli/manifest.mjs) and land together on one `yad update`. It is
+# the plain add-before-remove ladder instead: accept the new spelling now, switch the workflow
+# templates to emit it in a later release, drop the old one after that. Every shipped template still
+# passes `--profile hub` today, so this arm is dead weight until that switch — which is the point.
+#
+# Normalised to `hub` immediately, so nothing below has to know there are two spellings. That is
+# load-bearing in pr-title.sh and pr-template.sh: leave `$PROFILE` as `product` and the `= hub`
+# branch is skipped, taking the whole review-branch arm with it — including the guard that stops a
+# plain code title carrying an artifact change past its review.
+[ "$PROFILE" = product ] && PROFILE=hub
 
-# True when the PR changes a Shape artifact (anything under epics/**). Reads the --changed list
+
+# True when the PR changes a Shape artifact (anything under epics/** — or foundation/**, the Product level, E75). Reads the --changed list
 # of paths CI computed from the PR diff; with no list (direct caller / test) it reports false.
-artifact_changed() { [ -n "$CHANGED" ] && [ -f "$CHANGED" ] && grep -qE '^epics/' "$CHANGED"; }
+# A step owner file (`yad assign`, E47) is not an artifact: an assignment is advice, reviewed by nobody, and
+# a review/EP-* PR would advance the step on merge. So a PR of owner files alone is not an artifact change.
+# No `-q` on the second grep: under pipefail an early exit would SIGPIPE the first and read as "no artifact".
+# `"?`: git still C-quotes a path holding `"`, `\`, a tab or a newline, even with core.quotePath=false. Such a
+# line counts as an artifact, and the owner exemption never matches it — so it fails closed.
+# `LC_ALL=C grep -a` on both: with quotePath off a path's high bytes arrive raw, and GNU grep under a UTF-8
+# locale drops a line that is not valid UTF-8 from its output — the pipe would then read as "no artifact".
+artifact_changed() { [ -n "$CHANGED" ] && [ -f "$CHANGED" ] && LC_ALL=C grep -aE '^"?(epics|foundation)/' "$CHANGED" | LC_ALL=C grep -avE '^(epics/EP-[^/]+|foundation)/\.sdlc/owners/[^/]+\.json$' >/dev/null; }
 
 BODY="${ARGS[0]:-}"
 if [ -z "$BODY" ] || [ ! -f "$BODY" ]; then
@@ -75,7 +98,7 @@ require_heading() {
 }
 
 # The code task template: `## Summary`, `## Impact & Risk`, `## Checklist`, and a filled `Risk level:`.
-# Used by the code profile and by hub tooling PRs (any head branch that is not review/EP-*).
+# Used by the code profile and by Product tooling PRs (any head branch that is not review/EP-*).
 check_code_body() {
   require_heading '## Summary' '## Summary'
   require_heading '## Impact & Risk' '## Impact & Risk'
@@ -95,11 +118,11 @@ check_code_body() {
 check_hub_body() {
   require_heading '## Artifact under review' '## Artifact under review'
   # Add before you remove (change-safety rule 3). `front-half` is the ORIGINAL spelling and it is
-  # still what `yad gate open` emits and what the shipped hub template carries; `Shape` is the
+  # still what `yad gate open` emits and what the shipped Product template carries; `Shape` is the
   # replacement, accepted here first so that this script is lenient BEFORE anything starts writing
   # the new wording. That ordering is the whole point: this file is refreshed by `yad update`
-  # (HUB_WIRING, cli/manifest.mjs), but the PR template beside it is NOT — it is installed only by
-  # the `yad-pr-template repo:hub action: wire` skill, which nothing runs automatically. So a hub
+  # (PRODUCT_WIRING, cli/manifest.mjs), but the PR template beside it is NOT — it is installed only by
+  # the `yad-pr-template repo:hub action: wire` skill, which nothing runs automatically. So a Product
   # WILL sit with a refreshed checker next to an old template, and the checker has to accept both.
   # The emitter flips to `(Shape)` in the next major; only after that may `front-half` be dropped.
   require_heading '## Impact & Risk \((front-half|Shape)\)' '## Impact & Risk (front-half)'
@@ -115,11 +138,11 @@ if [ "$PROFILE" = hub ]; then
   case "$HEADREF" in
     review/EP-*|"") check_hub_body ;;            # artifact-review PR (or unknown head — stay strict)
     *)
-      # tooling/code change to the hub itself — UNLESS it changes Shape artifacts (epics/**),
+      # tooling/code change to the Product itself — UNLESS it changes Shape artifacts (epics/**),
       # which must go through a review/EP-* PR. Without this guard a non-review head could carry an
       # artifact change past the Shape review with only the code template.
       if artifact_changed; then
-        echo "FAIL [pr-template]: head '${HEADREF}' changes Shape artifacts (epics/**) but is not a review/EP-* branch — artifact changes must go through a review PR."
+        echo "FAIL [pr-template]: head '${HEADREF}' changes Shape artifacts (epics/** or foundation/**) but is not a review/EP-* branch — artifact changes must go through a review PR."
         rc=1
       else
         check_code_body; KIND="hub-tooling"

package/skills/yad-pr-template/templates/checks/pr-title.sh

@@ -6,13 +6,15 @@
 #     the squash-merge subject). Keep <type> in sync with cli/manifest.mjs COMMIT_TYPES.
 #   --profile hub — a Shape artifact-review title "review: <artifact> (EP-<slug>)", the shape
 #     `yad gate open` creates (cli/gate.mjs) — BUT only for review/EP-* head branches. Every other
-#     hub PR is a tooling/code change to the hub itself and follows the code convention; pass the
+#     Product PR is a tooling/code change to the Product itself and follows the code convention; pass the
 #     head ref via --head so the gate can tell the two apart (a tooling PR has no EP artifact to
-#     review). With no --head, the hub profile stays strict (requires the review shape).
+#     review). With no --head, the Product profile stays strict (requires the review shape).
 #     Branch name is not enough on its own: a non-review head that actually changes Shape
 #     artifacts (epics/**) would otherwise slip past the review workflow with a plain code title.
 #     Pass the PR's changed paths via --changed <file> (one path per line); when they touch epics/**
 #     on a non-review head the gate FAILS — artifact changes must go through a review/EP-* PR.
+#     Build the list with `git -c core.quotePath=false diff --no-renames --name-only`: without
+#     --no-renames a rename lists only its new path, and the removed artifact is never seen.
 # The title is passed as the (single) positional arg; CI injects it from the event payload
 # (GitHub: github.event.pull_request.title; GitLab: $CI_MERGE_REQUEST_TITLE).
 set -euo pipefail
@@ -32,11 +34,32 @@ while [ $# -gt 0 ]; do
     *) ARGS+=("$1"); shift ;;
   esac
 done
-case "$PROFILE" in code|hub) ;; *) echo "FAIL [pr-title]: unknown --profile '$PROFILE' (code|hub)."; exit 1 ;; esac
+case "$PROFILE" in code|hub|product) ;; *) echo "FAIL [pr-title]: unknown --profile '$PROFILE' (code|hub|product)."; exit 1 ;; esac
+# `product` is the new name for the `hub` profile and BOTH are accepted.
+#
+# Not because the two sides update separately — they do not: this script and the workflow that passes
+# the flag are both in PRODUCT_WIRING (cli/manifest.mjs) and land together on one `yad update`. It is
+# the plain add-before-remove ladder instead: accept the new spelling now, switch the workflow
+# templates to emit it in a later release, drop the old one after that. Every shipped template still
+# passes `--profile hub` today, so this arm is dead weight until that switch — which is the point.
+#
+# Normalised to `hub` immediately, so nothing below has to know there are two spellings. That is
+# load-bearing in pr-title.sh and pr-template.sh: leave `$PROFILE` as `product` and the `= hub`
+# branch is skipped, taking the whole review-branch arm with it — including the guard that stops a
+# plain code title carrying an artifact change past its review.
+[ "$PROFILE" = product ] && PROFILE=hub
 
-# True when the PR changes a Shape artifact (anything under epics/**). Reads the --changed list
+
+# True when the PR changes a Shape artifact (anything under epics/** — or foundation/**, the Product level, E75). Reads the --changed list
 # of paths CI computed from the PR diff; with no list (direct caller / test) it reports false.
-artifact_changed() { [ -n "$CHANGED" ] && [ -f "$CHANGED" ] && grep -qE '^epics/' "$CHANGED"; }
+# A step owner file (`yad assign`, E47) is not an artifact: an assignment is advice, reviewed by nobody, and
+# a review/EP-* PR would advance the step on merge. So a PR of owner files alone is not an artifact change.
+# No `-q` on the second grep: under pipefail an early exit would SIGPIPE the first and read as "no artifact".
+# `"?`: git still C-quotes a path holding `"`, `\`, a tab or a newline, even with core.quotePath=false. Such a
+# line counts as an artifact, and the owner exemption never matches it — so it fails closed.
+# `LC_ALL=C grep -a` on both: with quotePath off a path's high bytes arrive raw, and GNU grep under a UTF-8
+# locale drops a line that is not valid UTF-8 from its output — the pipe would then read as "no artifact".
+artifact_changed() { [ -n "$CHANGED" ] && [ -f "$CHANGED" ] && LC_ALL=C grep -aE '^"?(epics|foundation)/' "$CHANGED" | LC_ALL=C grep -avE '^(epics/EP-[^/]+|foundation)/\.sdlc/owners/[^/]+\.json$' >/dev/null; }
 
 TITLE="${ARGS[0]:-}"
 if [ -z "$TITLE" ]; then
@@ -47,7 +70,7 @@ fi
 TYPES='feat|fix|docs|refactor|test|perf|build|ci|chore|revert'
 
 # Conventional-Commits subject (optional scope + breaking `!`), no trailing period. Used by the code
-# profile and by hub tooling PRs (any head branch that is not review/EP-*).
+# profile and by Product tooling PRs (any head branch that is not review/EP-*).
 check_code_title() {
   if ! printf '%s' "$TITLE" | grep -qE "^(${TYPES})(\([a-z0-9._-]+\))?!?: .+"; then
     echo "FAIL [pr-title]: '${TITLE}' is not '<type>(<scope>)?!?: <description>' (type one of: ${TYPES//|/, })."
@@ -69,15 +92,15 @@ if [ "$PROFILE" = hub ]; then
         echo "PASS [pr-title]: '${TITLE}' (profile: hub, artifact-review)"
         exit 0
       fi
-      echo "FAIL [pr-title]: '${TITLE}' is not a hub review title 'review: <artifact> (EP-<slug>)'."
+      echo "FAIL [pr-title]: '${TITLE}' is not a Product review title 'review: <artifact> (EP-<slug>)'."
       exit 1
       ;;
     *)
-      # Any other hub PR is a tooling/code change to the hub itself — UNLESS it changes Shape
+      # Any other Product PR is a tooling/code change to the Product itself — UNLESS it changes Shape
       # artifacts (epics/**), which must go through a review/EP-* PR. Without this guard a non-review
       # head could carry an artifact change past the Shape review with only a code title.
       if artifact_changed; then
-        echo "FAIL [pr-title]: head '${HEADREF}' changes Shape artifacts (epics/**) but is not a review/EP-* branch — artifact changes must go through a review PR."
+        echo "FAIL [pr-title]: head '${HEADREF}' changes Shape artifacts (epics/** or foundation/**) but is not a review/EP-* branch — artifact changes must go through a review PR."
         exit 1
       fi
       # tooling only — fall through to the code convention.

package/skills/yad-pr-template/templates/checks/risk-route.sh

@@ -1,11 +1,24 @@
 #!/usr/bin/env bash
-# Risk routing (Phase 3 build plan §D). Reads a PR/MR description's Impact & Risk block and prints the
-# required reviewers, reusing yad-review-gate's escalation: a `high` risk level — or a touched
-# contract/auth/payments surface — requires a domain-owner approval per touched domain, on top of the
-# base rule (owner + 1 reviewer). Advisory: it ROUTES the human review; it does not approve or merge.
+# Risk routing (Phase 3 build plan §D). Reads a PR/MR description's Impact & Risk block and prints how
+# many approvers the change asks for, as the same sum the review gate prints: base 1, plus a risk step —
+# `high` risk +1, a touched contract surface +2, the larger of the two and never their sum. The count is
+# advisory on the Build half: branch protection holds the merge, and this script cannot apply the capacity
+# cap (E72), which needs the Product's count of active people — `yad open-pr` shows the capped count.
+# There are no roles and no named owners: yadflow keeps no list of people (E62), so when a risk step
+# raises the count the touched domains are printed as a hint for whom to ask (with no risk step it prints
+# the base line alone). Advisory: it ROUTES the human review; it does not approve or merge.
+#
+# E66 — the risk map counts too. Run inside the code repo, ON THE PR'S BRANCH, it also asks
+# `checks/risk-map-check.sh --level` which directories the change touches on the BASE branch's
+# `.sdlc/risk-map`: a `high` one adds the high step (+1). The largest step wins, so the body can raise
+# the count and never lower it — a body saying `low` on a change to a `high` directory still counts +1,
+# and the output says the two disagree. When the map cannot be read, it says so and counts the body
+# alone; it never guesses a level.
+#
+#   risk-route.sh <pr-description-file> [<base>]     <base> defaults the way the checks resolve it
 set -euo pipefail
 
-BODY="${1:?usage: risk-route.sh <pr-description-file>}"
+BODY="${1:?usage: risk-route.sh <pr-description-file> [<base>]}"
 [ -f "$BODY" ] || { echo "risk-route: file not found: $BODY" >&2; exit 2; }
 
 # Value side of the FIRST line matching a label regex, with any HTML comment + markdown markers
@@ -24,21 +37,101 @@ echo "Risk level: ${risk:-unspecified}"
 echo "Contract surface touched: ${contract:-unspecified}"
 echo "Domains touched: ${domains:-unspecified}"
 
-if [ "$risk" = "high" ] || [ "$contract" = "yes" ]; then
-  why=""
-  [ "$risk" = "high" ] && why="risk: high"
-  [ "$contract" = "yes" ] && why="${why:+$why, }contract surface touched"
-  echo "ROUTE: ESCALATED (${why}) -> owner + 1 reviewer PLUS one domain-owner approval per touched domain"
-  echo "       (same escalation as yad-review-gate). Required domain owners:"
+# The map's level for this change, from the risk-map check beside this script (wired together as
+# checks/), or from the repo's checks/ when this copy runs from elsewhere. Machine lines, see that file.
+here="$(cd "$(dirname "$0")" 2>/dev/null && pwd)" || here=""
+checker=""
+for c in "${here:+$here/}risk-map-check.sh" checks/risk-map-check.sh; do
+  if [ -f "$c" ]; then checker="$c"; break; fi
+done
+if [ -z "$checker" ]; then
+  lv="UNKNOWN checks/risk-map-check.sh is not here — wire it with \`yad update\`"
+else
+  lv="$(bash "$checker" --level ${2:+"$2"} 2>/dev/null)" || lv="UNKNOWN checks/risk-map-check.sh failed"
+fi
+line_of() { printf '%s\n' "$lv" | sed -n "s/^$1 //p" | head -1; }
+dirs_of() { printf '%s\n' "$lv" | awk -v want="$1" '$1 == "DIR" && $3 == want { printf "%s%s%s", sep, $2, ($4 == "guessed") ? " (guessed)" : ""; sep = ", " }'; }
+# A risk-map check from before E66 has no --level mode: it reads the flag as a base and prints warnings,
+# none of the lines above. Reading that as "nothing is high" would be a guess, so it is unknown instead.
+if [ -z "$(line_of UNKNOWN)$(line_of NOMAP)$(line_of LEVEL)" ]; then
+  lv="UNKNOWN checks/risk-map-check.sh cannot count the risk map yet (it predates E66) — update it with \`yad update\`"
+fi
+map_base="$(line_of BASE)"
+map_high=""
+# E67 — the people the check found with recent commits in those `high` directories: `WHO <login|-> <name>`.
+# `$1 = ""` would rebuild the line with one space between fields and squash a name's own spacing.
+who_list() { printf '%s\n' "$lv" | sed -n 's/^WHO //p' | awk '{ login = $1; name = $0; sub(/^[^ ]* /, "", name); printf "%s%s%s", sep, name, (login == "-" || name == "@" login) ? "" : " (@" login ")"; sep = ", " }'; }
+if [ -n "$(line_of UNKNOWN)" ]; then
+  echo "Risk map: not counted — $(line_of UNKNOWN). Only the body is counted."
+elif [ -n "$(line_of NOMAP)" ]; then
+  echo "Risk map: none — $(line_of NOMAP), so no directory adds a step."
+else
+  map_high="$(dirs_of high)"
+  map_medium="$(dirs_of medium)"
+  if [ "$(line_of FILES)" = "0" ]; then
+    echo "Risk map (${map_base}): this checkout changes no file against ${map_base} — run it on the PR's branch."
+  elif [ -n "$map_high" ]; then
+    echo "Risk map (${map_base}): high — ${map_high}"
+  else
+    echo "Risk map (${map_base}): $(line_of LEVEL) — nothing this change touches is high"
+  fi
+  [ -z "$map_medium" ] || echo "  medium (reported only, adds nothing): ${map_medium}"
+  if [ -n "$map_high" ]; then
+    hist_unknown="$(line_of HISTUNKNOWN)"; who="$(who_list)"
+    # A check older than E67 answers nothing about history: no WHO, and no HISTNONE saying it looked.
+    # Reading that silence as "nobody" would drop the ask — the same mistake as reading a failure as zero.
+    if [ -z "$hist_unknown" ] && [ -z "$who" ] && [ -z "$(printf '%s\n' "$lv" | sed -n 's/^HISTNONE$/x/p')" ]; then
+      hist_unknown="checks/risk-map-check.sh cannot answer this yet (it predates E67) — update it with \`yad update\`"
+    fi
+    if [ -n "$hist_unknown" ]; then
+      echo "  who has worked there lately: not read — ${hist_unknown}"
+    elif [ -n "$who" ]; then
+      echo "  worked there in the last 30 days: ${who}"
+    else
+      echo "  nobody else has committed there in the last 30 days"
+    fi
+  fi
+fi
+
+step=0
+tier=""
+why=""
+if [ "$risk" = "high" ]; then step=1; tier=high; why="risk: high"; fi
+if [ -n "$map_high" ]; then
+  [ "$step" -ge 1 ] || { step=1; tier=high; }
+  why="${why:+$why, }high on the risk map: ${map_high}"
+fi
+if [ "$contract" = "yes" ]; then step=2; tier=contract; why="${why:+$why, }contract surface touched"; fi
+
+if [ "$step" -gt 0 ]; then
+  echo "ROUTE: $((1 + step)) approvers = base 1 + ${tier} risk ${step} (${why})"
+  # The body can raise the count and never lower it: say so when it tried to.
+  if [ -n "$map_high" ] && [ "$risk" != "high" ]; then
+    echo "       The body says Risk level: ${risk:-unspecified}, but the risk map on ${map_base} marks ${map_high} high — the larger counts."
+  fi
+  echo "       Branch protection (when configured) holds the merge, not this count: at least 1 approval (GitHub blocks self-approval; GitLab only if its settings do)."
+  echo "       The risk step is advisory, and not capped here — \`yad open-pr\` shows the count capped by the active people."
+  # E67 — a change to a `high` directory asks for an approval from someone who has worked there in the
+  # last 30 days. Reported, like the count: it names who can meet it and blocks nothing. With nobody to
+  # name (or a history that could not be read), the touched domains stay the only hint.
+  if [ -n "$map_high" ] && [ -n "$(who_list)" ]; then
+    echo "       This change touches ${map_high}, so it asks for an approval from someone who has"
+    echo "       committed there in the last 30 days (its own authors left out):"
+    printf '%s\n' "$lv" | sed -n 's/^WHO //p' | while IFS= read -r row; do
+      login="${row%% *}"; name="${row#* }"
+      if [ "$login" = "-" ] || [ "$name" = "@${login}" ]; then echo "  - ${name}"; else echo "  - ${name} (@${login})"; fi
+    done
+  fi
+  echo "       Ask reviewers who know the touched domains:"
   case "$domains" in
     ""|*"<"*|*"…"*|*"|"*)
-      echo "  (Domains line not filled in — list each touched domain to route the owners.)" ;;
+      echo "  (Domains line not filled in — list each touched domain so the right reviewers can be asked.)" ;;
     *)
       printf '%s\n' "$domains" | tr ',' '\n' | while IFS= read -r d; do
         d="$(printf '%s' "$d" | sed -E 's/^[[:space:]]*//; s/[[:space:]]*$//')"
-        [ -n "$d" ] && echo "  - domain-owner: $d"
+        if [ -n "$d" ]; then echo "  - $d"; fi   # not `&&`: an empty last item (`a, b,`) would exit 1
       done ;;
   esac
 else
-  echo "ROUTE: base rule -> owner + 1 reviewer (no domain-owner escalation)."
+  echo "ROUTE: 1 approver = base 1 (no risk step)."
 fi

package/skills/yad-pr-template/templates/github/pull_request_template.md

@@ -12,12 +12,14 @@
 <!-- Fill every field. risk-route.sh + the engineer review read this block. -->
 - **Domains / repos touched:** <backend | mobile | …>
 - **Contract surface touched:** no <!-- yes => needs Contract-Change + a re-locked contract (contract-check) -->
-- **Risk level:** low <!-- low | medium | high — high (or a contract/auth/payments surface) routes to domain owners -->
+- **Risk level:** low <!-- low | medium | high — high (or a touched contract surface) raises the advisory approver count -->
 - **Rollback plan:** <how to revert if this misbehaves>
 
-> **Routing:** `low`/`medium` → base rule (owner + 1 reviewer). `high` (or a touched
-> contract/auth/payments surface) → **plus one domain-owner approval per touched domain**, the same
-> escalation `yad-review-gate` applies. Run `bash checks/risk-route.sh <this-description>` to list them.
+> **Routing:** the merge needs **1 approval, which should not be the author’s own**. `high` risk adds 1
+> and a touched contract surface adds 2 to the count (the larger, never the sum); that step is advisory
+> (`yad open-pr` shows it capped by the active people). A change to a directory the base branch's `.sdlc/risk-map` marks `high` adds 1
+> too, even when this says `low`. Run `bash checks/risk-route.sh <this-description>` on this branch to
+> print the count.
 
 ## Testing
 <!-- How the acceptance criteria were exercised. Tests must exercise behavior, not just pass. -->
@@ -27,4 +29,4 @@
 - [ ] No contract-surface change without `Contract-Change: yes` + a re-locked contract (contract-check gate)
 - [ ] Lint, build, and tests pass (build/test/lint gate)
 - [ ] Diff stays inside the files the task's spec declared (≤3 where possible)
-- [ ] Impact & Risk filled; `high` risk adds the required domain-owner reviewers
+- [ ] Impact & Risk filled; for `high` risk, ask reviewers who know the touched domains

package/skills/yad-pr-template/templates/gitlab/merge_request_templates/Default.md

@@ -16,12 +16,14 @@
 <!-- Fill every field. risk-route.sh + the engineer review read this block. -->
 - **Domains / repos touched:** <backend | mobile | …>
 - **Contract surface touched:** no <!-- yes => needs Contract-Change + a re-locked contract (contract-check) -->
-- **Risk level:** low <!-- low | medium | high — high (or a contract/auth/payments surface) routes to domain owners -->
+- **Risk level:** low <!-- low | medium | high — high (or a touched contract surface) raises the advisory approver count -->
 - **Rollback plan:** <how to revert if this misbehaves>
 
-> **Routing:** `low`/`medium` → base rule (owner + 1 reviewer). `high` (or a touched
-> contract/auth/payments surface) → **plus one domain-owner approval per touched domain**, the same
-> escalation `yad-review-gate` applies. Run `bash checks/risk-route.sh <this-description>` to list them.
+> **Routing:** the merge needs **1 approval, which should not be the author’s own**. `high` risk adds 1
+> and a touched contract surface adds 2 to the count (the larger, never the sum); that step is advisory
+> (`yad open-pr` shows it capped by the active people). A change to a directory the base branch's `.sdlc/risk-map` marks `high` adds 1
+> too, even when this says `low`. Run `bash checks/risk-route.sh <this-description>` on this branch to
+> print the count.
 
 ## Testing
 <!-- How the acceptance criteria were exercised. Tests must exercise behavior, not just pass. -->
@@ -31,6 +33,6 @@
 - [ ] No contract-surface change without `Contract-Change: yes` + a re-locked contract (contract-check gate)
 - [ ] Lint, build, and tests pass (build/test/lint gate)
 - [ ] Diff stays inside the files the task's spec declared (≤3 where possible)
-- [ ] Impact & Risk filled; `high` risk adds the required domain-owner reviewers
+- [ ] Impact & Risk filled; for `high` risk, ask reviewers who know the touched domains
 
 /assign me

package/skills/yad-pr-template/templates/hub/github/pull_request_template.md

@@ -1,7 +1,7 @@
 <!-- SDLC HUB PR template — Shape artifact review (epic / architecture+contract / ui-design / stories). -->
-<!-- This PR is a REVIEW VEHICLE on the product hub, not a code merge. The file gate (yad-review-gate)
-     advances the step; do NOT rely on merging this PR to advance. Reviewers approve/comment here, then a
-     `yad-review-gate action: sync` pulls that into the file ledger. -->
+<!-- This PR is a REVIEW VEHICLE on the Product, not a code merge. The file gate (yad-review-gate)
+     advances the step when this PR is MERGED with the approvals met and every thread resolved. Reviewers
+     approve/comment here; `yad gate sync` (or CI at merge, with a verified ledger) pulls that into the file ledger. -->
 
 ## Artifact under review
 - Epic: `EP-<slug>`
@@ -14,23 +14,24 @@
 
 ## Impact & Risk (front-half)
 - **Domains / repos touched:** <epic.repos, e.g. backend, mobile>
-- **Risk tags:** <none | contract | auth | payments>  <!-- contract/auth/payments => escalates to domain owners -->
+- **Risk tags:** <none | contract | auth | payments>  <!-- contract/auth/payments => raises the advisory approver count -->
 - **Contract surface:** <n/a | locked @ sha256:…>  <!-- architecture only; a re-lock invalidates prior approvals -->
 
 ## Required approvals (yad-review-gate rule)
-- Base: **owner + 1 reviewer**.
-- Escalated (risk tag set, or a stories PR): **plus one domain-owner per touched repo** — see the
-  requested reviewers / `domain:<repo>` labels on this PR. Run `bash checks/hub-route.sh <this-description>`
-  to list them.
+- Full count, in **distinct people**: base 1 + the step's risk step — 3 on a `contract` step, 2 on
+  `auth`/`payments`, 1 otherwise (the largest step, never the sum). No approval should be the author’s own.
+- Enforced: **1 approval** (the base). The risk step is **advisory**. `yad gate status <epic>`
+  prints the count capped at the active people less one (one seat is left for the author), and
+  `yad-hub-bridge`'s `hub-route.sh` run on this description prints the full count.
+- No reviewers are requested automatically — ask them on this PR. The `domain:<repo>` labels show the touched repos.
 
 ## How to review (this drives the gate)
-- **Approve** this PR to record an `owner` / `reviewer` / `domain-owner` approval in the file ledger
-  (your platform login maps to your SDLC name + role via `.sdlc/hub.json`'s roster).
+- **Approve** this PR to record your approval in the file ledger, under your platform login (no role).
 - **Comment / request changes** to record review comments (synced into `reviews/<artifact>--<date>--comments.md`).
-- **Do NOT merge to advance** — `yad-review-gate action: sync` + `action: advance` move the step.
+- **Merge to advance** — once the approvals are met and every thread is resolved, merging this PR moves the step (CI records it with a verified ledger; otherwise `yad gate sync`).
 
 ## Checklist
 - [ ] `owner` set in the artifact frontmatter (inherited from `epic.md`)
-- [ ] Contract re-locked (`.sdlc/contract-lock.json`) if the surface changed (architecture only)
-- [ ] Risk tags reflect the real surface touched (contract/auth/payments escalate)
+- [ ] Contract re-locked (`.sdlc/contract-lock.json`) if the surface changed (architecture only — a short-lane epic has no architecture step and no lock, so tick this only if your route has one)
+- [ ] Risk tags reflect the real surface touched (contract/auth/payments raise the approval count)
 - [ ] No secrets or tokens in the artifact or this description