yadflow 4.0.0-next.3 → 4.0.0

package/cli/platform.mjs

@@ -1,5 +1,5 @@
 // Platform adapter — the ONLY place that shells out to gh/glab. Read recipes mirror
-// skills/yad-hub-bridge/references/bridge.md. Everything runs as the local user (gh/glab own auth);
+// skills/yad-product-bridge/references/bridge.md. Everything runs as the local user (gh/glab own auth);
 // no tokens are stored. Pure mapping fns (resolveLogin/mapApprovers) are exported for unit tests;
 // readPr is injectable so the gate can be tested with a fake.
 import { URLSearchParams } from 'node:url';
@@ -22,6 +22,12 @@ export function cliFor(platform) {
 // Bare host from a git remote URL, for hostname-scoped CLI auth checks. Handles both the
 // `https://[user@]host[:port]/...` and the scp-like `git@host:group/repo.git` forms. Returns
 // null when nothing parses (caller falls back to an unscoped check).
+// A host yad may use in a CLI call or print — inside `gh auth login --hostname <host>`, say — or null. The
+// host comes from shared files (hub.json, repos.json) or a clone's remote, and `hostFromGitUrl` passes
+// `$(curl …|sh)` or an escape through, so a host must be a plain host name or a bracketed IPv6 address.
+// ONE test for every caller (E81 reviews 13–14: the second copy was missed once).
+export const plainHost = (h) => (typeof h === 'string' && /^(?:\w[\w-]*(?:\.[\w-]+)*|\[[0-9a-f:.]+\])$/i.test(h) ? h : null);
+
 export function hostFromGitUrl(url = '') {
   if (typeof url !== 'string' || !url.trim()) return null;
   const u = url.trim();
@@ -97,9 +103,9 @@ export function actorName(cwd, platform, opts = {}) {
 // logins that share it. An older record under such a
 // name could be either person, so it is never matched by name — only as `upsertBridge` matches a record
 // no name can place (an exact submission time, or an open step's one-to-one).
-export function ambiguousLegacyNames(hub) {
+export function ambiguousLegacyNames(productConfig) {
   const logins = new Map();
-  for (const e of Array.isArray(hub?.roster) ? hub.roster : []) {
+  for (const e of Array.isArray(productConfig?.roster) ? productConfig.roster : []) {
     if (!e || typeof e.name !== 'string' || !e.name || typeof e.login !== 'string' || !e.login) continue;
     if (!logins.has(e.name)) logins.set(e.name, new Set());
     logins.get(e.name).add(e.login);
@@ -397,9 +403,9 @@ export function platformDefaultBranch(platform, { cwd, runner = run } = {}) {
 // though only this chain has a platform rung — they stop at the local `origin/HEAD`:
 //   1 flag        — an explicit --base; the human said so
 //   2 registry    — the repo's `default_branch` in .sdlc/repos.json
-//   3 hub         — hub.json's `default_branch`, for a PR against the Product itself
+//   3 product     — the Product settings' `default_branch`, for a PR against the Product itself
 //   4 platform    — what the remote says (see platformDefaultBranch)
-//   5 origin-head — local `refs/remotes/origin/HEAD`, the same read repo.mjs/hubcommit.mjs use.
+//   5 origin-head — local `refs/remotes/origin/HEAD`, the same read repo.mjs/productcommit.mjs use.
 //                   Deliberately NOT `ls-remote`: see branchExists above for why a network probe on
 //                   this path is a hang hazard.
 //   6 fallback    — 'main'
@@ -415,7 +421,7 @@ export function platformDefaultBranch(platform, { cwd, runner = run } = {}) {
 // and an early rung winning, `platformDefault` is null because it was never asked, not because the
 // platform had no answer.
 export function resolveBaseBranch(platform, {
-  cwd, explicit = null, meta = null, hub = null, runner = run, probe = true,
+  cwd, explicit = null, meta = null, productConfig = null, runner = run, probe = true,
 } = {}) {
   let platformDefault = null;
   let asked = false;
@@ -434,7 +440,7 @@ export function resolveBaseBranch(platform, {
   const chain = [
     ['flag', explicit],
     ['registry', meta?.default_branch],
-    ['hub', hub?.default_branch],
+    ['product', productConfig?.default_branch],
     ['platform', askPlatform],
     ['origin-head', originHead],
   ];

package/cli/product-index.mjs

@@ -24,7 +24,7 @@ import { createHash } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { isPlainObject, writeJSON, info, warn } from './lib.mjs';
 import { isVerifiedLedger } from './manifest.mjs';
-import { productGit, resolveDefaultBranch } from './hubcommit.mjs';
+import { productGit, resolveDefaultBranch } from './productcommit.mjs';
 import {
   epicIds, epicRel, epicRoot, unlistedLedgerDirs, parseFrontmatter, lineageFrom, stepStatus, STEP_STATES,
   FOUNDATION_EPIC, FOUNDATION_TITLE, titleOf,
@@ -270,11 +270,11 @@ export function uncommittedIndexInputs(root, commits = null) {
 // The index is derived: a failure to rebuild it is said, and never stops the gate write it follows.
 // Returns whether the file changed, so a caller that commits can carry it in the same commit. `quiet`
 // for a caller whose stdout is JSON: the warning still goes to stderr.
-export function refreshIndexAfterWrite(root, hub, { quiet = false } = {}) {
-  if (isVerifiedLedger(hub) || !fs.existsSync(path.join(root, '.git'))) return false;
+export function refreshIndexAfterWrite(root, productConfig, { quiet = false } = {}) {
+  if (isVerifiedLedger(productConfig) || !fs.existsSync(path.join(root, '.git'))) return false;
   const git = productGit(root);
   const branch = git('rev-parse', '--abbrev-ref', 'HEAD').stdout;
-  if (!branch || branch !== resolveDefaultBranch(git, hub)) return false;
+  if (!branch || branch !== resolveDefaultBranch(git, productConfig)) return false;
   try {
     const changed = writeIndex(root);
     if (changed && !quiet) info(`rebuilt ${INDEX_FILE}`);

package/cli/{hubcommit.mjs → productcommit.mjs}

@@ -2,7 +2,8 @@
 // `yad checkpoint` (sync new state) and `yad tidy up` (fold finished shards). Both must commit ONLY on
 // the default branch, so their `[skip ci]` commit never enters a PR's base..HEAD range (where it would
 // strand required checks and fail verified-commits). This module is the single home of that guard.
-import { warn, fail, hand, run } from './lib.mjs';
+import { warn, fail, hand, run, forTerminal } from './lib.mjs';
+import { SETTINGS_EDIT_HINT, settingsEditHint } from './manifest.mjs';
 
 export const productGit = (root) => (...args) => run('git', args, { cwd: root });
 
@@ -22,9 +23,9 @@ export function preflightGuardReadiness(root, why = 'the yad-update-guard requir
 // NEVER the current branch — falling back to it (as gate.mjs does, safe there because CI checks out the
 // default branch) would make the guard below a no-op on a WIP branch and let an unsigned commit land in
 // a future PR's range.
-export function resolveDefaultBranch(git, hub) {
+export function resolveDefaultBranch(git, productConfig) {
   const originHead = git('symbolic-ref', '--short', 'refs/remotes/origin/HEAD'); // e.g. "origin/main"
-  return hub?.default_branch
+  return productConfig?.default_branch
     || (originHead.ok && originHead.stdout ? originHead.stdout.replace(/^origin\//, '') : '')
     || 'main';
 }
@@ -32,14 +33,17 @@ export function resolveDefaultBranch(git, hub) {
 // Guard: only commit on the default branch. Returns true when OK; on a non-default branch it prints the
 // refusal + sets a non-zero exit code, unless `allowBranch` overrides (with a warning). `--allow-branch`
 // is the SINGLE documented override — never `--force` (which elsewhere only waives the atomic guard).
-export function guardDefaultBranch(branch, defaultBranch, { allowBranch = false, cmd = 'yad checkpoint' } = {}) {
+// `root` (the Product) lets the hint name the exact settings file to edit; without it the hint says it in words.
+export function guardDefaultBranch(branch, defaultBranch, { allowBranch = false, cmd = 'yad checkpoint', root = null } = {}) {
   if (branch === defaultBranch) return true;
+  // Printed cleaned (E81 review 13): `default_branch` comes from the Product's shared hub.json.
+  const [b, d] = [forTerminal(branch), forTerminal(defaultBranch)];
   if (allowBranch) {
-    warn(`--allow-branch: committing on '${branch}' — pushes go to origin/${branch}, and this commit needs a verified signature to pass the gate in a PR`);
+    warn(`--allow-branch: committing on '${b}' — pushes go to origin/${b}, and this commit needs a verified signature to pass the gate in a PR`);
     return true;
   }
-  fail(`on '${branch}', not the default branch '${defaultBranch}' — ${cmd} commits go to the default branch to stay out of PR-checked ranges`);
-  hand(`switch to '${defaultBranch}' and re-run, or pass --allow-branch to override (set default_branch in .sdlc/hub.json if '${defaultBranch}' is wrong)`);
+  fail(`on '${b}', not the default branch '${d}' — ${cmd} commits go to the default branch to stay out of PR-checked ranges`);
+  hand(`switch to '${d}' and re-run, or pass --allow-branch to override (if '${d}' is wrong, set default_branch in ${root ? settingsEditHint(root) : SETTINGS_EDIT_HINT})`);
   process.exitCode = 1;
   return false;
 }

package/cli/protection.mjs

@@ -23,15 +23,18 @@
 // leaves the machine for anywhere else). `YAD_PLATFORM_READ=0` turns the reads off — for offline work, and
 // for the test suite, which must never ask the developer's real account (the `YAD_PLATFORM_LOGIN=0`
 // precedent). `runner` is injectable so every answer is testable without a network.
-import { run } from './lib.mjs';
-import { cliFor, hostFromGitUrl, detectPlatform } from './platform.mjs';
+import { run, forTerminal } from './lib.mjs';
+import { SETTINGS_EDIT_HINT } from './manifest.mjs';
+import { cliFor, hostFromGitUrl, detectPlatform, plainHost } from './platform.mjs';
 
 export const PLATFORM_NAME = { github: 'GitHub', gitlab: 'GitLab' };
 const TIMEOUT = 10_000;
 
 // A word with an `@` after its first character may be an e-mail address, and no address is ever printed
 // (E67). A branch or a repo path is printed as written otherwise.
-export const shown = (w) => (typeof w === 'string' && w.indexOf('@', 1) >= 0 ? 'a name with an @ in it' : `${w}`);
+// Also cleaned for the terminal (E81 review 12): a branch or repo from the shared registry could hold a
+// control character, and every line here prints through this.
+export const shown = (w) => (typeof w === 'string' && w.indexOf('@', 1) >= 0 ? 'a name with an @ in it' : forTerminal(`${w}`));
 
 // The repo's path on its host (`owner/repo`, or `group/sub/project` on GitLab), from a git remote URL in
 // either form. Not the `repoSlug` the doctor used to carry, which kept only the last two parts and so named
@@ -165,7 +168,11 @@ function loggedIn(runner, cli, host, authCache) {
 //                                                            a GitLab answer carries no such key)
 // `kind` names the reason for a hint, so the hint never depends on the words of `why`.
 export function readProtection({ platform, gitUrl, branch = null, branchFrom = 'registry' } = {}, { runner = run, env = process.env, authCache = new Map() } = {}) {
-  const host = hostFromGitUrl(gitUrl || '');
+  // A host that is not a plain host name is never used or repeated (E81 review 13): it comes from the
+  // shared registry's `git_url` (or a registered clone's own remote), and it is printed inside
+  // `gh auth login --hostname …` for the person to run — `$(curl …|sh)` parses as a host.
+  const rawHost = hostFromGitUrl(gitUrl || '');
+  const host = plainHost(rawHost);
   const repo = repoPathFromGitUrl(gitUrl || '');
   const plat = platform || detectPlatform(gitUrl || '') || null;
   const base = { platform: plat, host, repo, branch, branchFrom, platformDefault: null };
@@ -173,10 +180,11 @@ export function readProtection({ platform, gitUrl, branch = null, branchFrom = '
   const cli = cliFor(plat);
   if (!cli) {
     return platform
-      ? unknown('no-platform', `yad does not know the platform ${JSON.stringify(platform)} (it reads GitHub and GitLab)`)
+      ? unknown('no-platform', `yad does not know the platform ${JSON.stringify(forTerminal(platform))} (it reads GitHub and GitLab)`)
       : unknown('no-platform', 'no platform (GitHub or GitLab) is set, so there is no platform to ask');
   }
   if (env.YAD_PLATFORM_READ === '0') return unknown('off', 'platform reads are turned off (YAD_PLATFORM_READ=0)');
+  if (rawHost && !host) return unknown('no-url', 'the git remote URL names a host that is not a plain host name, so yad does not ask about it', { badHost: true });
   if (!host || !repo) return unknown('no-url', 'no git remote URL yad can read, so it cannot tell which repo to ask about');
   if (!runner(process.platform === 'win32' ? 'where' : 'which', [cli], {}).ok) return unknown('no-cli', `${cli} is not installed, so yad cannot ask ${PLATFORM_NAME[plat]}`);
   if (!loggedIn(runner, cli, host, authCache)) return unknown('no-login', `${cli} is not logged in for ${host} (or ${host} did not answer)`);
@@ -440,7 +448,7 @@ function readGitLab(base, runner, unknown) {
         const named = typeof r.name === 'string' && r.name.trim() ? r.name.trim() : null;
         // A rule NAMED "42" and a rule with ID 42 must not read the same, so an id is printed as an id —
         // the shape the GitHub side already uses ("a repo ruleset (id 7)").
-        if (named !== null) out.from.push(`approval rule ${JSON.stringify(named)}`);
+        if (named !== null) out.from.push(`approval rule ${JSON.stringify(forTerminal(named))}`);
         else out.from.push(count(r.id) !== null ? `an approval rule (id ${r.id})` : 'an approval rule');
       }
       // A rule the platform DID return that does not reach this branch: say which way it misses, so the
@@ -488,7 +496,7 @@ function readGitLab(base, runner, unknown) {
 }
 
 // The doctor line for one answer: { status: 'ok'|'warn', message, hint }. `name` is the repo's name in
-// yad (or "Product hub"). In solo mode (the user's decision) the facts print as `ok` with no banner — one
+// yad (or "Product"). In solo mode (the user's decision) the facts print as `ok` with no banner — one
 // person cannot approve their own pull request, so "no approval rules" may be the right setup — except
 // the old solo warning: a required approval there blocks the solo developer's own merge.
 //
@@ -682,7 +690,9 @@ function unknownHint(r) {
     case 'no-cli': return `install ${cli} and log in, then run \`yad doctor\` again`;
     case 'no-login': return `run \`${cli} auth login --hostname ${r.host}\`, then \`yad doctor\` again`;
     case 'no-platform': return 'set `platform` (github or gitlab) in yad\'s files — `yad setup` for the Product, `yad repo connect` for a code repo';
-    case 'no-url': return 'add `git_url` to the repo\'s entry in .sdlc/repos.json (.sdlc/product.json, or hub.json, for the Product), or give the repo an origin remote';
+    case 'no-url': return r.badHost
+      ? `fix \`git_url\` in the repo's entry in .sdlc/repos.json (for the Product, ${SETTINGS_EDIT_HINT}) — or its origin remote — to name a plain host`
+      : `add \`git_url\` to the repo's entry in .sdlc/repos.json (for the Product, ${SETTINGS_EDIT_HINT}), or give the repo an origin remote`;
     // The access tail turns on what the read PROVED (`cause`), never on the platform: a 404 whose body was
     // not recognised leaves a permission open, and one that named the branch closes it (E109).
     // The tail's noun is GitLab's: GitHub never reaches it, because its reader sets `cause: 'branch'` on
@@ -697,7 +707,7 @@ function unknownHint(r) {
     case 'no-flag': return `ask someone who can see ${PLATFORM_NAME[r.platform] || 'the platform'}'s settings for ${shown(r.branch) === r.branch ? `\`${r.branch}\`` : shown(r.branch)}`;
     // One action per open cause (E110): yad's files name no branch, and on GitLab the repository may be
     // unreadable — turned off (an Owner turns it on) or too little access (a Maintainer or Owner grants it).
-    case 'no-default': return `set \`default_branch\` in yad's files (.sdlc/repos.json, or .sdlc/product.json — hub.json on an older Product)${r.defaultMayBeHidden
+    case 'no-default': return `set \`default_branch\` in yad's files (.sdlc/repos.json, or for the Product ${SETTINGS_EDIT_HINT})${r.defaultMayBeHidden
       ? `. GitLab also hides the default from a login that cannot read the repository: ${REPO_ACTIONS} — then run \`yad doctor\` again`
       : ''}`;
     case 'no-repo': return `check \`git_url\` in yad's files, or ask for access to the ${r.platform === 'gitlab' ? 'project' : 'repo'}`;

package/cli/reconcile.mjs

@@ -4,25 +4,31 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import {
-  c, log, ok, info, warn, hand, readJSON, writeJSON, exists,
+  c, log, ok, info, warn, hand, readJSON, writeJSON, exists, forTerminal,
 } from './lib.mjs';
 
 const readFileSafe = (p) => { try { return fs.readFileSync(p, 'utf8'); } catch { return ''; } };
 
-import { preflightGuardReadiness } from './hubcommit.mjs';
-import { VERSION, PROJECT_FILES, MANAGED_LEDGER, BACKUP_SUFFIX , productConfigPath } from './manifest.mjs';
+import { preflightGuardReadiness } from './productcommit.mjs';
+import { VERSION, PROJECT_FILES, MANAGED_LEDGER, BACKUP_SUFFIX , productConfigPath, PRODUCT_LINK } from './manifest.mjs';
 import {
   moduleActions, repoActions, productActions, hookActions,
-  legacyModuleActions, removedModuleActions, orphanHookActions, captureHookActions, orphanCaptureHookActions, legacyRepoActions, legacyHubActions,
-  ideTargetStateFor, recordManagedWrites,
+  legacyModuleActions, removedModuleActions, orphanHookActions, captureHookActions, orphanCaptureHookActions, legacyHookScriptActions, legacyRepoActions, legacyProductActions,
+  ideTargetStateFor, recordManagedWrites, gitHookActions, orphanGitHookActions, gitHookState, gitHookAdvice, renamedNameHits, withoutKeptRenames, PRODUCT_PROFILE_GATES, productProfileGap, productProfileEffect, PRODUCT_PROFILE_FIX, workflowsPassingProduct, productGateBlockers, oldProfileAdvice,
 } from './plan.mjs';
 import { gitHead, packRepo } from './setup.mjs';
 import { groupByRoot, commitUpdates, repoLabel } from './update-commit.mjs';
+import { hasSiblingRepo, workspaceFileState, writeWorkspaceFile, WORKSPACE_FILE } from './find-product.mjs';
 
 const MARK = { missing: c.red('missing'), new: c.cyan('new'), outdated: c.yellow('outdated'), modified: c.cyan('modified'), stale: c.yellow('stale'), legacy: c.yellow('legacy'), removed: c.yellow('removed'), ok: c.green('ok') };
 
 // The --json answer's list (E1): every managed item, as the report groups it — never the apply step.
-const itemsOf = (actions) => actions.map((a) => ({ scope: a.scope, item: a.item, status: a.status }));
+// `product` says whose item it is: false for a connected repo's, true for the Product's own (E124 review 1).
+// The scope alone cannot say it — a repo may be named `product`, the Product's own scope.
+// A repo named `product` shares the Product's scope; in printed text it is shown with its path (E124 review 2).
+const repoShown = (repo) => `product (the code repo at ${forTerminal(repo.path)})`;
+const shown = (a) => a.shownScope ?? a.scope;
+const itemsOf = (actions) => actions.map((a) => ({ scope: a.scope, item: a.item, status: a.status, product: !a.fromRepo }));
 
 export async function reconcile(root, { fix = false, scope = 'all', force = false, push = false, allowBranch = false, overwriteLocal = false } = {}) {
   log(c.bold(`\nSDLC reconcile  ${c.dim('v' + VERSION)}`));
@@ -31,7 +37,7 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   // --- missing one-time setup (needs the interactive wizard) ---
   const gaps = [];
   if (!exists(path.join(root, PROJECT_FILES.version))) gaps.push('module not installed (.sdlc/cli-version.json absent)');
-  if (!exists(productConfigPath(root))) gaps.push('hub not configured (.sdlc/hub.json absent)');
+  if (!exists(productConfigPath(root))) gaps.push('Product not configured (.sdlc/product.json absent)');
   const registry = readJSON(path.join(root, PROJECT_FILES.reposRegistry), { repos: [] });
   if (!exists(path.join(root, PROJECT_FILES.reposRegistry))) gaps.push('no repos registered (.sdlc/repos.json absent)');
 
@@ -51,14 +57,19 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   //     and purge of skills removed in a later release ('removed': delete the lingering install) ---
   const actions = [
     ...moduleActions(root, ideTargets), ...legacyModuleActions(root, ideTargets), ...removedModuleActions(root, ideTargets),
-    ...productActions(root), ...legacyHubActions(root), ...hookActions(root, ideTargets),
+    // E123: a renamed CI file the team edited is kept, and its new name is not installed beside it.
+    ...withoutKeptRenames([...productActions(root), ...legacyProductActions(root)]), ...hookActions(root, ideTargets),
     ...orphanHookActions(root, ideTargets),
+    // E48: this clone's git pre-commit hook — the person's half of the ledger guard.
+    ...gitHookActions(root), ...orphanGitHookActions(root),
     // E43: the post-edit capture hook, in both ledger modes.
     ...captureHookActions(root, ideTargets), ...orphanCaptureHookActions(root, ideTargets),
+    // E113: the old shell-script hooks. LAST, so the entries above that named them are rewritten first.
+    ...legacyHookScriptActions(root, ideTargets),
   ];
   if (ideState.needsRepair) {
     actions.push({
-      scope: 'hub',
+      scope: 'product',
       item: `${PROJECT_FILES.version} ideTargets`,
       status: 'outdated',
       root,
@@ -67,7 +78,12 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
       apply: () => undefined,
     });
   }
-  for (const repo of registry.repos) actions.push(...repoActions(root, repo), ...legacyRepoActions(root, repo));
+  for (const repo of registry.repos) {
+    const own = withoutKeptRenames([...repoActions(root, repo), ...legacyRepoActions(root, repo)]);
+    // Set on the action itself: later steps compare actions by identity. `true`, not the name, which may be empty.
+    for (const a of own) { a.fromRepo = true; if (repo.name === 'product') a.shownScope = repoShown(repo); }
+    actions.push(...own);
+  }
 
   // --- stale code-context (HEAD moved since last pack) ---
   const staleRepos = [];
@@ -75,12 +91,14 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
     const head = gitHead(path.resolve(root, repo.path));
     if (head && repo.syncedHead && head !== repo.syncedHead) {
       staleRepos.push(repo);
-      // packRepo writes the repomix cache under the HUB root (root/repo.contextPack, e.g.
+      // packRepo writes the repomix cache under the Product root (root/repo.contextPack, e.g.
       // .sdlc/code-context/<name>/pack.md), so the touched path belongs to the Product — and is commonly
       // gitignored, in which case the push stage's check-ignore drops it. codeMap is AI-generated
       // later, not here, so only the pack is claimed.
       actions.push({
         scope: repo.name,
+        fromRepo: true, // about the repo, though its file is under the Product
+        ...(repo.name === 'product' ? { shownScope: repoShown(repo) } : {}),
         item: 'code-context',
         status: 'stale',
         root,
@@ -93,8 +111,8 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   // --- report, grouped by scope ---
   const byScope = new Map();
   for (const a of actions) {
-    if (!byScope.has(a.scope)) byScope.set(a.scope, []);
-    byScope.get(a.scope).push(a);
+    if (!byScope.has(shown(a))) byScope.set(shown(a), []);
+    byScope.get(shown(a)).push(a);
   }
   const counts = { missing: 0, new: 0, outdated: 0, modified: 0, stale: 0, legacy: 0, removed: 0, ok: 0 };
   for (const [scopeName, items] of byScope) {
@@ -105,6 +123,23 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
     for (const i of notOk) log(`    ${MARK[i.status]}  ${i.item}`);
   }
   for (const g of gaps) warn(g);
+  // E123: the team's own files that name one of our renamed CI names — each with its file and line, the same
+  // list `yad doctor` shows. yad never edits them; the include line it rewrites is said as what it is.
+  // After this run: a gate it replaces handles `product`; one it keeps (edited) may not (E124 review 3).
+  // No `drift` here on purpose: under drift the dispatcher refuses `yad check`/`update` before this runs.
+  const profileFirst = oldProfileAdvice(productGateBlockers(root, { fix, overwriteLocal }));
+  for (const h of renamedNameHits(root)) {
+    if (h.rewrittenBy === 'update' || (h.rewrittenBy === 'overwrite-local' && overwriteLocal)) {
+      info(`${h.file}:${h.line} includes the old fragment — ${fix ? 'rewritten' : `rewritten by ${h.rewrittenBy === 'update' ? '`yad check --fix`/`yad update`' : '`yad update --overwrite-local`'}`} to name ${h.new}`);
+    } else if (h.rewrittenBy === 'overwrite-local') {
+      info(`${h.file}:${h.line} includes the edited old fragment — \`yad update --overwrite-local\` rewrites it when it replaces that fragment; leave it until then`);
+    } else if (h.profile && profileFirst) {
+      warn(`${h.file}:${h.line} passes \`${h.old}\`, renamed \`${h.new}\` in 4.0 — change it by hand, ${profileFirst}`);
+    } else warn(`${h.file}:${h.line} names \`${h.old}\`, renamed \`${h.new}\` in 4.0 — yad does not edit this file; change it by hand`);
+  }
+  // A hook yad may not write (someone else's, or a hooks folder a tool manages) has no action; say so.
+  const gitHookNote = gitHookAdvice(gitHookState(root));
+  if (gitHookNote) warn(gitHookNote);
   const shownInvalid = ideState.invalid.map((v) => {
     try { return JSON.stringify(v) ?? String(v); } catch { return String(v); }
   });
@@ -135,7 +170,10 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   // `--overwrite-local` replaces it, which still saves the previous content beside it.
   const modified = actions.filter((a) => a.status === 'modified');
   for (const m of modified) {
-    warn(`${m.scope}/${m.item} is locally modified — it matches neither the shipped template nor the copy yad wrote`);
+    // The product-link record has no template: it is `modified` only when it is not a JSON object (E120).
+    warn(m.item === PRODUCT_LINK
+      ? `${shown(m)}/${m.item} is not a JSON object — left alone (--overwrite-local saves it and writes a new one)`
+      : `${shown(m)}/${m.item} is locally modified — it matches neither the shipped template nor the copy yad wrote`);
   }
   // A gate-sync fragment is kept like any other edited file — but it also decides which yadflow CI runs.
   // It trusts a committed version only from its own major (`YAD_MAJOR`), and the version stamp is
@@ -150,13 +188,37 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
       return found ? Number(found[1]) : null;
     } catch { return null; }
   };
-  for (const m of modified.filter((a) => a.managed && /yad-gate-sync\.ya?ml$/.test(a.item))) {
+  for (const m of modified.filter((a) => a.managed && !a.rename && /yad-gate-sync\.ya?ml$/.test(a.item))) {
     const kept = pinMajorOf(m.managed.dest);
     const ships = pinMajorOf(m.managed.src);
     if (kept === null || ships === null || kept === ships) continue;
-    warn(`${m.scope}/${m.item} trusts only yadflow ${kept}.x pins, but this release's fragment trusts ${ships}.x — kept as it is, CI will skip the new version stamp and run yadflow@${kept}`);
+    warn(`${shown(m)}/${m.item} trusts only yadflow ${kept}.x pins, but this release's fragment trusts ${ships}.x — kept as it is, CI will skip the new version stamp and run yadflow@${kept}`);
     hand(`re-apply your edit on top of the new fragment, or replace it with \`yad update --overwrite-local\` (your copy is saved beside it as ${path.basename(m.managed.dest)}${BACKUP_SUFFIX})`);
   }
+  // A renamed file the team edited (E123): kept under its old name, so say that the rename is half done and
+  // how to finish it. True whatever else this run does: the old file goes on running (GitHub) or being the
+  // one the root .gitlab-ci.yml includes (GitLab) until --overwrite-local replaces it.
+  // An edited Product gate that does not handle the profile the Product's checks workflow passes (E123): kept,
+  // and then it fails every Product PR, or passes what it should stop. Said only when a workflow passing
+  // `product` is on disk or this run installs one — the same test `yad doctor` makes (review 2).
+  const productRel = (p) => path.relative(root, p).split(path.sep).join('/');
+  const installsProduct = actions.filter((a) => a.managed && a.managed.root === root
+    && /(^|\/)yad-product-checks\.yml$/.test(productRel(a.managed.dest))
+    && a.status !== 'ok' && a.status !== 'modified' && (scope === 'all' || a.status !== 'missing'))
+    .map((a) => productRel(a.managed.dest));
+  const passing = [...new Set([...workflowsPassingProduct(root), ...installsProduct])];
+  for (const m of overwriteLocal || !passing.length ? [] : modified.filter((a) => a.managed && a.managed.root === root && !a.rename
+    && PRODUCT_PROFILE_GATES.includes(productRel(a.managed.dest)))) {
+    const gap = productProfileGap(m.managed.dest);
+    if (!gap) continue;
+    warn(`${m.scope}/${productProfileEffect(gap, m.item, `${passing.join(' and ')} ${passing.length > 1 ? 'pass' : 'passes'}`)} — it was edited, so it is kept`);
+    hand(`${PRODUCT_PROFILE_FIX} (your copy is saved as ${path.basename(m.managed.dest)}${BACKUP_SUFFIX})`);
+  }
+  for (const m of overwriteLocal ? [] : modified.filter((a) => a.rename)) {
+    const { from, to } = m.rename;
+    warn(`${shown(m)}/${from} was renamed ${to} in this release, but it was edited, so it is kept — ${from.startsWith('.gitlab/') ? 'the root .gitlab-ci.yml goes on including it' : 'it goes on running'} under its old name`);
+    hand(`\`yad update --overwrite-local\` replaces it with ${to} (your copy is saved as ${path.basename(from)}${BACKUP_SUFFIX}); then copy your edits into ${to}`);
+  }
   if (modified.length && !overwriteLocal) {
     hand(`keep the edits (reported as \`modified\` on every check), or replace them with \`yad update --overwrite-local\` — each previous version is saved beside the file as <file>${BACKUP_SUFFIX}`);
   }
@@ -169,10 +231,15 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   log('');
   log(c.dim(`summary: ${counts.missing} missing, ${counts.new} new, ${counts.outdated} outdated, ${counts.modified} modified, ${counts.stale} stale, ${counts.legacy} legacy, ${counts.removed} removed, ${counts.ok} ok`));
 
+  // E80: the workspace file beside the Product, for one whose repos live beside it. Per machine, outside
+  // the Product repo — so never staged by --push. Reported here; written by --fix below.
+  const wsNeeded = exists(productConfigPath(root)) && hasSiblingRepo(root);
+  let workspaceFile = wsNeeded ? workspaceFileState(root) : null;
   if (!fix) {
+    if (workspaceFile === 'missing') info(`no ${WORKSPACE_FILE} beside the Product — \`yad check --fix\` writes it, so yad finds the Product from its code repos`);
     if (push) warn('--push has no effect without --fix (there is nothing applied to commit).');
     if (fixable.length || gaps.length) hand('run `yad check --fix` to reconcile (or `yad setup` for missing one-time setup).');
-    return { fix: false, counts, gaps, items: itemsOf(actions), applied: 0, modified: modified.length, commits: [] };
+    return { fix: false, counts, gaps, items: itemsOf(actions), applied: 0, modified: modified.length, commits: [], workspaceFile };
   }
 
   // --- apply --- (collect the applied actions so --push can stage each repo's exact allowlist) ---
@@ -185,17 +252,20 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
     appliedActions.push(a);
     // A backup means the replaced content was not provably ours (a pre-ledger install, or an edit
     // --overwrite-local was told to discard). Never report that as an ordinary template adoption.
-    info(`${a.status} → fixed: ${a.scope}/${a.item}${a.backup ? ` ${c.yellow(`(previous content saved to ${path.basename(a.backup)})`)}` : ''}`);
+    info(`${a.status} → fixed: ${shown(a)}/${a.item}${a.backup ? ` ${c.yellow(`(previous content saved to ${path.basename(a.backup)})`)}` : ''}`);
   }
   if (force) {
     // --force re-copies what is already correct; it deliberately does NOT reach a `modified` file —
     // only --overwrite-local discards a local edit, and only after backing it up.
     for (const a of actions.filter((a) => a.status === 'ok')) { a.apply(); appliedActions.push(a); }
   }
+  // A file that is right on disk but not committed as it stands, which --push must still commit: the
+  // product-link record (E120) — the gates read it from the default branch, not from anyone's disk.
+  if (push) for (const a of actions) if (a.pendingCommit && !appliedActions.includes(a)) appliedActions.push(a);
   // Refresh the version stamp and persist only the canonical targets used to build actions. This also
   // completes legacy/corrupt target migration even when no skill content itself needed an update.
   writeCanonicalStamp();
-  appliedActions.push({ scope: 'hub', item: PROJECT_FILES.version, status: 'stamp', root, paths: [PROJECT_FILES.version] });
+  appliedActions.push({ scope: 'product', item: PROJECT_FILES.version, status: 'stamp', root, paths: [PROJECT_FILES.version] });
   // Record what we wrote (and what was already correct) so the NEXT update can tell a stale managed
   // file from an edited one. Seeding the already-correct files is what migrates a pre-ledger install.
   // A file left as `modified` records nothing — it differs from the template by definition.
@@ -205,6 +275,11 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
       root: ledgerRoot, paths: [MANAGED_LEDGER],
     });
   }
+  if (workspaceFile === 'missing') {
+    workspaceFile = writeWorkspaceFile(root) === 'written' ? 'written' : workspaceFileState(root);
+    // Said with its full path: it is the one file this command writes OUTSIDE the Product.
+    if (workspaceFile === 'written') warn(`wrote ${path.join(path.dirname(path.resolve(root)), WORKSPACE_FILE)} (this machine only) — run from inside a repo this Product registers, yad finds the Product; delete the file to stop that`);
+  }
   applied ? ok(`reconciled ${applied} item(s)`) : info('nothing to fix');
   if (modified.length && !overwriteLocal) {
     warn(`${modified.length} locally modified file(s) left untouched — this update did not reach them`);
@@ -217,9 +292,9 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
   let commits = [];
   if (push) {
     preflightGuardReadiness(root);
-    const hub = readJSON(productConfigPath(root), {});
-    const defByRoot = new Map([[root, hub?.default_branch]]);
-    const platformByRoot = new Map([[root, hub?.platform]]);
+    const productConfig = readJSON(productConfigPath(root), {});
+    const defByRoot = new Map([[root, productConfig?.default_branch]]);
+    const platformByRoot = new Map([[root, productConfig?.platform]]);
     for (const repo of registry.repos) {
       const repoRoot = path.resolve(root, repo.path);
       defByRoot.set(repoRoot, repo.default_branch);
@@ -239,5 +314,5 @@ export async function reconcile(root, { fix = false, scope = 'all', force = fals
       },
     });
   }
-  return { fix: true, counts, gaps, items: itemsOf(actions), applied, modified: modified.length, commits };
+  return { fix: true, counts, gaps, items: itemsOf(actions), applied, modified: modified.length, commits, workspaceFile };
 }

package/cli/repo-publish.mjs

@@ -16,23 +16,27 @@
 //      commit never enters a PR's base..HEAD range where it would strand required checks.
 import fs from 'node:fs';
 import path from 'node:path';
-import { c, ok, info, fail, hand, exists, pushWithRebase } from './lib.mjs';
+import { c, ok, info, fail, hand, exists, pushWithRebase, forTerminal } from './lib.mjs';
 import { PROJECT_FILES , productConfigPath } from './manifest.mjs';
 import { loadProduct } from './gate.mjs';
 import { platformLogin } from './platform.mjs';
-import { productGit, resolveDefaultBranch, guardDefaultBranch, preflightGuardReadiness } from './hubcommit.mjs';
+import { productGit, resolveDefaultBranch, guardDefaultBranch, preflightGuardReadiness } from './productcommit.mjs';
 import { ensurePackIgnored, PACK_IGNORE_BLOCK } from './setup.mjs';
 import { checkpointAuthor } from './checkpoint.mjs';
+import { codeContextPathOk } from './workspace.mjs';
 
 // Collapse any whitespace/newline runs to a single space — keeps a hostile `git user.name` or a stray
 // path from breaking the one-line subject or injecting a fake trailer line.
 const oneLine = (s = '') => String(s).replace(/\s+/g, ' ').trim();
 
 // The tracked code-map for a repo: the registered path, else the conventional location.
-const codeMapOf = (repo) => repo.codeMap || path.posix.join('.sdlc/code-context', repo.name, 'code-map.md');
+// A registry entry with no `name` (or a name that is not text) and no path of its own has no place
+// here: null, which `codeContextPathOk` refuses — never a throw halfway through a publish (E81 review 2).
+const inContext = (repo, file) => (typeof repo?.name === 'string' && repo.name ? path.posix.join('.sdlc/code-context', repo.name, file) : null);
+export const codeMapOf = (repo) => repo.codeMap || inContext(repo, 'code-map.md');
 
 // The repomix pack for a repo: the registered path, else the conventional location.
-const packOf = (repo) => repo.contextPack || path.posix.join('.sdlc/code-context', repo.name, 'pack.md');
+export const packOf = (repo) => repo.contextPack || inContext(repo, 'pack.md');
 
 // PURE — the repo-relative pathspecs to stage: the registry plus each registered repo's code-map that
 // exists on disk. When `name` is given (a scoped `yad repo refresh <name> --push`), only that repo's
@@ -41,9 +45,11 @@ const packOf = (repo) => repo.contextPack || path.posix.join('.sdlc/code-context
 export function codeMapPathspecs(root, registry = { repos: [] }, name = null) {
   const out = [];
   for (const repo of registry.repos || []) {
-    if (name && repo.name !== name) continue;
+    if (!repo || typeof repo !== 'object' || (name && repo.name !== name)) continue;
     const rel = codeMapOf(repo);
-    if (fs.existsSync(path.join(root, rel))) out.push(rel);
+    // Shared registry text chooses this path, and it is committed and pushed: only under
+    // .sdlc/code-context/ in the Product, never through `..`, `.git` or a link (E81).
+    if (codeContextPathOk(root, rel) && fs.existsSync(path.join(root, rel))) out.push(rel);
   }
   // The registry always rides along — `yad repo refresh` stamps syncedHead/lastSyncedAt into it.
   if (fs.existsSync(path.join(root, PROJECT_FILES.reposRegistry))) out.push(PROJECT_FILES.reposRegistry);
@@ -57,9 +63,9 @@ export function codeMapPathspecs(root, registry = { repos: [] }, name = null) {
 export function packPathspecs(root, registry = { repos: [] }, name = null) {
   const out = [];
   for (const repo of registry.repos || []) {
-    if (name && repo.name !== name) continue;
+    if (!repo || typeof repo !== 'object' || (name && repo.name !== name)) continue;
     const rel = packOf(repo);
-    if (fs.existsSync(path.join(root, rel))) out.push(rel);
+    if (codeContextPathOk(root, rel) && fs.existsSync(path.join(root, rel))) out.push(rel);
   }
   return out;
 }
@@ -122,12 +128,12 @@ export function summarizeCodeContext(files = []) {
 }
 
 // PURE — the audit-trail commit message. Subject passes the Product commit-message gate (valid type
-// `chore`, scope `hub`, non-empty description, no trailing period). No Task trailer and no
+// `chore`, scope `product`, non-empty description, no trailing period). No Task trailer and no
 // Co-Authored-By: this is human-owned machine state, not an authored code change. `[skip ci]` mirrors
 // `yad checkpoint` — it lands on the default branch and needs no PR gate suite. `label`/`author` are
 // collapsed to one line so nothing can split the subject or forge a trailer.
 export function buildCodeMapMessage({ label, author, basenames = [] }) {
-  const subject = `chore(hub): sync code-context — ${oneLine(label)} by ${oneLine(author)} [skip ci]`;
+  const subject = `chore(product): sync code-context — ${oneLine(label)} by ${oneLine(author)} [skip ci]`;
   const body = basenames.length ? `Updated: ${basenames.join(', ')}` : '';
   return body ? `${subject}\n\n${body}` : subject;
 }
@@ -137,18 +143,18 @@ export function buildCodeMapMessage({ label, author, basenames = [] }) {
 export async function publishCodeContext(root, { push = false, allowBranch = false, name = null } = {}) {
   if (!exists(path.join(root, '.git'))) { fail('not a git repo'); process.exitCode = 1; return; }
   if (!exists(productConfigPath(root))) {
-    fail('no .sdlc/hub.json — --push publishes the Product code-context; run it from the Product');
+    fail('no .sdlc/product.json — --push publishes the Product code-context; run it from the Product');
     process.exitCode = 1;
     return;
   }
 
-  const { hub, repos } = loadProduct(root);
+  const { productConfig, repos } = loadProduct(root);
   const registry = { repos: repos || [] };
   const git = productGit(root);
 
   const branch = git('rev-parse', '--abbrev-ref', 'HEAD').stdout;
-  const defaultBranch = resolveDefaultBranch(git, hub);
-  if (!guardDefaultBranch(branch, defaultBranch, { allowBranch, cmd: 'yad repo refresh --push' })) return;
+  const defaultBranch = resolveDefaultBranch(git, productConfig);
+  if (!guardDefaultBranch(branch, defaultBranch, { allowBranch, cmd: 'yad repo refresh --push', root })) return;
 
   // Stage the EXPLICIT allowlist (code-maps + registry), scoped so an unrelated pre-staged file is never
   // swept in and the user's index is left untouched — mirrors `runCheckpoint`. NEVER `git add -A` and
@@ -213,7 +219,7 @@ export async function publishCodeContext(root, { push = false, allowBranch = fal
   if (push) preflightGuardReadiness(root);
 
   const { label, basenames } = summarizeCodeContext(fileset);
-  const author = checkpointAuthor(platformLogin(root, hub?.platform), git('config', 'user.name').stdout);
+  const author = checkpointAuthor(platformLogin(root, productConfig?.platform), git('config', 'user.name').stdout);
   const message = buildCodeMapMessage({ label, author, basenames });
 
   // Untrack the packs by holding their bytes and removing the files across the --only commit, then
@@ -236,7 +242,7 @@ export async function publishCodeContext(root, { push = false, allowBranch = fal
   } finally {
     for (const h of held) if (!fs.existsSync(h.abs)) fs.writeFileSync(h.abs, h.buf);
   }
-  ok(`published ${fileset.length} file(s): ${c.dim(label)}`);
+  ok(`published ${fileset.length} file(s): ${c.dim(forTerminal(label))}`);   // a registry name can be in it (E81 review 15)
 
   if (!push) return { message, committed: true, pushed: false };
   return { message, committed: true, pushed: pushHead() };