yadflow 4.0.0-next.3 → 4.0.0

package/cli/setup.mjs

@@ -3,14 +3,14 @@ import path from 'node:path';
 import fs from 'node:fs';
 import os from 'node:os';
 import {
-  c, log, step, guide, ok, info, warn, hand, fail, ask, askYesNo, run, has,
+  c, log, step, guide, ok, info, warn, hand, fail, ask, askYesNo, run, runLauncher, has,
   exists, readJSON, readJSONStrict, writeJSON,
-  writeProductConfig,
+  writeProductConfig, forTerminal,
 } from './lib.mjs';
 import { VERSION, IDE_TARGETS, IDE_AGENTS, DEFAULT_IDE_TARGETS, PROJECT_FILES, DESIGN_TOOLS, DESIGN_PRIMARY, TESTING_TOOLS, TESTING_PRIMARY, LEARNING_TOOLS, LEARNING_PRIMARY , productConfigPath } from './manifest.mjs';
 import {
-  moduleActions, repoActions, productActions, hookActions, captureHookActions,
-  legacyModuleActions, removedModuleActions, legacyRepoActions, legacyHubActions,
+  moduleActions, repoActions, productActions, hookActions, captureHookActions, legacyHookScriptActions, gitHookActions, gitHookState, gitHookAdvice,
+  legacyModuleActions, removedModuleActions, legacyRepoActions, legacyProductActions, withoutKeptRenames,
   safeIdeTargetsFor, detectedIdeTargetStateFor, recordManagedWrites,
 } from './plan.mjs';
 import { modeFields, modeOf } from './mode.mjs';
@@ -55,6 +55,15 @@ export function detectPlatform(remoteUrl = '') {
 }
 export const gitHead = (cwd) => run('git', ['rev-parse', 'HEAD'], { cwd }).stdout || null;
 
+// A repo's (one `yad init` found beside the Product) default branch: the remote's published default, else the branch it is on (a repo with
+// no remote has nothing else to say), else main.
+export function detectDefaultBranch(repoDir) {
+  const originHead = run('git', ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], { cwd: repoDir });
+  if (originHead.ok && originHead.stdout) return originHead.stdout.replace(/^origin\//, '');
+  const current = run('git', ['symbolic-ref', '--short', 'HEAD'], { cwd: repoDir });
+  return (current.ok && current.stdout) || 'main';
+}
+
 // Containment: a repo path must live inside the WORKSPACE — the Product root's parent. The standard
 // multi-repo layout puts the code repos BESIDE the Product, not under it (project/{product,backend,frontend}),
 // so `../backend` has to register; containing to the Product root instead forced separate git repos to nest
@@ -76,15 +85,33 @@ export function insideWorkspace(root, rpath) {
   const parent = path.dirname(projectRoot);
   const workspace = parent === projectRoot ? projectRoot : parent; // degenerate: root is the fs root
   const resolved = path.resolve(projectRoot, rpath);
+  if (throughGitDir(root, rpath)) return false;
   return resolved === projectRoot || resolved.startsWith(workspace + path.sep);
 }
 
+// A repo path that runs through a `.git` folder is never a code repo (E79 review 2). `yad join` clones
+// every registered path with no person looking, and a clone that lands at `../.git` makes the workspace
+// a repo whose `config` the Product's writer chose (`core.fsmonitor` runs a command on `git status`);
+// one at `.git/hooks` puts their hooks in the Product. Git refuses a `.git` part in a tracked path for
+// the same reason. Matched without case (macOS and Windows file systems ignore it), and Windows' short
+// name for `.git` (`GIT~1`) too.
+export function throughGitDir(root, rpath) {
+  const projectRoot = path.resolve(root);
+  const parent = path.dirname(projectRoot);
+  const workspace = parent === projectRoot ? projectRoot : parent;
+  const parts = path.relative(workspace, path.resolve(projectRoot, rpath)).split(/[\\/]+/);
+  // Windows also drops trailing dots and spaces from a name and reads `name:stream` as `name`, so
+  // `.git.`, `.git ` and `.git::$INDEX_ALLOCATION` are all `.git` there — judged as git itself does.
+  const ntfs = (p) => p.split(':')[0].replace(/[. ]+$/, '');
+  return parts.some((p) => /^\.git$/i.test(ntfs(p)) || /^git~\d+$/i.test(ntfs(p)));
+}
+
 // Build the hub.json object for a (re)configure write: the fields this run collected, laid over the
 // existing file so nothing the wizard does not ask about is dropped. Mirrors the safe { ...cur } merge
 // on the keep path. That includes a `roster` or `verified_authors` an older release wrote (E62): the
 // wizard no longer collects or reads either, and it never deletes them — `yad doctor` names them as
 // unused instead.
-export function buildReconfiguredHub(cur, fields) {
+export function buildReconfiguredProductConfig(cur, fields) {
   return { ...(cur || {}), ...fields };
 }
 
@@ -92,6 +119,7 @@ export function buildReconfiguredHub(cur, fields) {
 // A path that is not a git repository is rejected and NOTHING is written — a registry entry with
 // syncedHead:null would only surface later as an unexplained "unknown status" in the CI gates.
 export function registerRepo(root, registry, { name, rpath, platform, default_branch = 'main', today = null, pack = true }) {
+  if (throughGitDir(root, rpath)) { warn(`${rpath} runs through a .git folder — not a code repo, skipped`); return null; }
   if (!insideWorkspace(root, rpath)) {
     warn(`${rpath} resolves outside the workspace (the project root's parent) — skipped`);
     return null;
@@ -245,21 +273,21 @@ function applyActions(actions, { force = false } = {}) {
 // otherwise we prompt with a default. Pure of side effects — it only reads. Returns
 // { solo, team_size, codebase, repo_layout, configureTools }.
 export async function resolveProfile(root, opts = {}) {
-  const hub = readJSON(productConfigPath(root), null);
-  const prev = (hub && hub.profile) || {};
+  const productConfig = readJSON(productConfigPath(root), null);
+  const prev = (productConfig && productConfig.profile) || {};
 
-  // 1. Solo or team (+ size). --solo / --team <n> win; else carry hub.solo forward; else ask.
+  // 1. Solo or team (+ size). --solo / --team <n> win; else carry the Product's `solo` forward; else ask.
   let solo, team_size;
   if (opts.solo) { solo = true; team_size = 1; }
   else if (opts.team != null) { team_size = Math.max(1, parseInt(opts.team, 10) || 1); solo = team_size <= 1; }
   // Either spelling carries forward: the older `review_gate.solo: true` also waives the gates, and asking again
   // would default a configured team Product to solo and switch approvals off with nobody choosing it (E10).
-  else if (typeof hub?.solo === 'boolean' || hub?.review_gate?.solo === true) { solo = modeOf(hub) === 'solo'; team_size = prev.team_size ?? (solo ? 1 : 2); }
+  else if (typeof productConfig?.solo === 'boolean' || productConfig?.review_gate?.solo === true) { solo = modeOf(productConfig) === 'solo'; team_size = prev.team_size ?? (solo ? 1 : 2); }
   else {
     // No mode recorded. The default used to come from the roster's size; it now comes from the team size
     // setup recorded, and a Product that exists with neither defaults to TEAM (E62). Solo waives every
     // approval, so it must be a choice, never what a scripted re-run of an old Product falls into.
-    const known = prev.team_size ?? (hub ? 2 : 1);
+    const known = prev.team_size ?? (productConfig ? 2 : 1);
     solo = !(await ask('Solo or team?', known > 1 ? 'team' : 'solo')).toLowerCase().startsWith('t');
     team_size = solo ? 1 : Math.max(2, parseInt(await ask('  how many team members?', String(Math.max(2, known))), 10) || 2);
   }
@@ -312,7 +340,7 @@ export async function runSetup(root, opts = {}) {
     if (await askYesNo('Not a git repo. Run `git init` here?', true)) {
       run('git', ['init'], { cwd: root });
       ok('git initialized');
-    } else warn('continuing without git — hub detection will be skipped');
+    } else warn('continuing without git — the Product platform will not be detected');
   } else ok('git repo detected');
   for (const tool of ['git', 'node']) has(tool) ? ok(`${tool} present`) : warn(`${tool} not found on PATH`);
   if (!has('npx')) warn('npx not found — repomix packing will be skipped');
@@ -365,18 +393,18 @@ export async function runSetup(root, opts = {}) {
   S('Product platform');
   guide(solo
     ? [
-      'Your hub is this repo on GitHub/GitLab (or none for a local gate).',
+      'Your Product is this repo on GitHub/GitLab (or none for a local gate).',
       'Solo: you review by merging your own PR (approval waived).',
     ]
     : [
-      'Your hub is this repo on GitHub/GitLab; reviewers approve artifacts there.',
+      'Your Product is this repo on GitHub/GitLab; reviewers approve artifacts there.',
       'yad keeps no list of people: anyone with access to the repo can approve, and the platform records who did.',
       'A gate needs one approval, which should not come from the author (GitHub blocks self-approval; GitLab only if its settings do).',
       'It also reports how many people it would like: 3 on a contract review, 2 where auth or payments is touched, 1 elsewhere. That extra number is advisory for now.',
     ]);
   const productPath = productConfigPath(root);
-  if (exists(productPath) && !(await askYesNo('hub.json exists — reconfigure?', false))) {
-    info('keeping existing .sdlc/hub.json');
+  if (exists(productPath) && !(await askYesNo(`${path.relative(root, productPath)} exists — reconfigure?`, false))) {
+    info(`keeping the existing ${path.relative(root, productPath)}`);
   } else {
     const remote = run('git', ['remote', 'get-url', 'origin'], { cwd: root });
     if (!remote.ok && exists(path.join(root, '.git'))) info('no origin remote — platform detection skipped');
@@ -407,14 +435,14 @@ export async function runSetup(root, opts = {}) {
     // the reader falls back to when `ledger` is absent, so nothing is lost by waiting: `yad migrate`
     // adds the key, and the setting it computes is the one these booleans just recorded.
     const onNewShape = (cur.schemaVersion ?? 1) >= 2 || !Object.keys(cur).length;
-    const next = buildReconfiguredHub(cur, {
+    const next = buildReconfiguredProductConfig(cur, {
       platform: enabled ? platform : null, git_url,
       ...(onNewShape ? { ledger: enabled ? 'verified' : 'local' } : {}),
       bridge_enabled: enabled, bridge: enabled,
       default_branch, ...setupModeFields(root, cur, solo, opts), profile: { codebase, repo_layout, team_size },
     });
     writeProductConfig(root, next);
-    ok(`wrote ${PROJECT_FILES.productConfig} + ${PROJECT_FILES.hubConfig}${solo ? ' (solo mode)' : ''}`);
+    ok(`wrote ${PROJECT_FILES.productConfig} + ${PROJECT_FILES.productConfigLegacy}${solo ? ' (solo mode)' : ''}`);
   }
   // Persist the profile + solo flag even on the "keeping existing" path, so re-running setup with new
   // flags (e.g. `yad setup --solo`) updates the mode without a full reconfigure. Merge, never clobber.
@@ -431,7 +459,7 @@ export async function runSetup(root, opts = {}) {
     if (modeMoved || JSON.stringify(cur.profile || {}) !== JSON.stringify({ codebase, repo_layout, team_size }) || backfillUrl) {
       writeProductConfig(root, { ...cur, ...(backfillUrl ? { git_url: backfillUrl } : {}), ...mode, profile: { codebase, repo_layout, team_size } });
       if (mode.mode_set) info(`mode: ${mode.mode_set.from} → ${mode.mode_set.to} (recorded as mode_set)`);
-      if (backfillUrl) info(`backfilled hub git_url from origin: ${backfillUrl}`);
+      if (backfillUrl) info(`backfilled the Product's git_url from origin: ${backfillUrl}`);
       else info(`recorded profile: ${solo ? 'solo' : `team(${team_size})`}, ${codebase}, ${repo_layout}`);
     }
   }
@@ -533,6 +561,24 @@ export async function runSetup(root, opts = {}) {
   const known = new Set(registry.repos.map((r) => r.name));
   const greenfield = codebase === 'greenfield';
   const mono = repo_layout === 'monorepo';
+  // `yad init` (E79) found these beside the Product: one yes/no each, with what git already knows about
+  // them — the platform from `origin`, the default branch from origin/HEAD or the branch it is on.
+  for (const d of (opts.discovered || []).filter((x) => !known.has(x.name))) {
+    const repoRoot = path.resolve(root, d.rpath);
+    const remote = run('git', ['remote', 'get-url', 'origin'], { cwd: repoRoot });
+    const platform = detectPlatform(remote.ok ? remote.stdout : '') || 'github';
+    const default_branch = detectDefaultBranch(repoRoot);
+    // "Connect" means what it means in the loop below: register it, and the wiring step then writes the
+    // CI gates and the PR template into it. Said here, because init asks for every repo at once.
+    if (!(await askYesNo(`Connect and wire ${d.name} (${d.rpath}, ${platform}, default branch ${default_branch}) — writes its CI gates + PR template?`, true))) continue;
+    const repo = registerRepo(root, registry, { name: d.name, rpath: d.rpath, platform, default_branch, today: opts.today ?? null, pack: !greenfield });
+    if (!repo) continue;
+    known.add(d.name);
+    ok(`registered ${d.name}`);
+    if (greenfield) info(`${d.name}: greenfield — skipped repomix pack (run \`yad repo refresh ${d.name}\` once it has code)`);
+    else packRepo(root, repo);
+    if (mono) { info('monorepo — one repo connected'); break; }
+  }
   if (await askYesNo(`Connect a code repo? ${c.dim(`(${registry.repos.length} already registered)`)}`, registry.repos.length === 0)) {
     for (;;) {
       const name = await ask('  repo name (blank to finish)', '');
@@ -540,6 +586,7 @@ export async function runSetup(root, opts = {}) {
       if (known.has(name)) { warn(`${name} already registered — skipping`); continue; }
       // Siblings of the Product are the common layout (project/{product,backend}) — `../backend` is valid.
       const rpath = await ask('    path (relative to project root, e.g. ../backend)', `demo-repos/${name}`);
+      if (throughGitDir(root, rpath)) { warn(`${rpath} runs through a .git folder — not a code repo, skipped`); continue; }
       if (!insideWorkspace(root, rpath)) { warn(`${rpath} resolves outside the workspace (the project root's parent) — skipped`); continue; }
       const detected = run('git', ['remote', 'get-url', 'origin'], { cwd: path.resolve(root, rpath) });
       const platform = (await ask('    platform (github/gitlab)', detectPlatform(detected.ok ? detected.stdout : '') || 'github')).toLowerCase();
@@ -563,38 +610,52 @@ export async function runSetup(root, opts = {}) {
   const wired = [];
   for (const repo of registry.repos) {
     log(`  ${c.bold(repo.name)} ${c.dim(`(${repo.platform})`)}`);
-    const repoWiring = repoActions(root, repo);
+    // Migrate renamed wired CI (marker-owned sdlc-*.yml -> yad-*.yml); a user-authored same-named file is
+    // never touched, and an edited one is kept without its new name beside it (E123, `withoutKeptRenames`).
+    const repoLegacy = legacyRepoActions(root, repo);
+    const repoWiring = withoutKeptRenames([...repoActions(root, repo), ...repoLegacy]).filter((a) => !repoLegacy.includes(a));
     applyActions(repoWiring, { force: true });
     wired.push(...repoWiring);
-    // Migrate pre-2.0 wired CI (marker-owned sdlc-*.yml -> yad-*.yml); a user-authored
-    // same-named file is never touched.
-    applyActions(legacyRepoActions(root, repo), { force: true });
+    applyActions(repoLegacy, { force: true });
   }
   // the Product: event-driven gate-sync CI, so platform approvals/merges drive `yad gate ci`
-  const hubWiring = productActions(root);
-  if (hubWiring.length) {
-    log(`  ${c.bold('hub')} ${c.dim('(gate-sync + verified-commits CI)')}`);
-    applyActions(hubWiring, { force: true });
-    wired.push(...hubWiring);
+  const productLegacy = legacyProductActions(root);
+  const productWiring = withoutKeptRenames([...productActions(root), ...productLegacy]).filter((a) => !productLegacy.includes(a));
+  if (productWiring.length) {
+    log(`  ${c.bold('product')} ${c.dim('(gate-sync + verified-commits CI)')}`);
+    applyActions(productWiring, { force: true });
+    wired.push(...productWiring);
   }
-  applyActions(legacyHubActions(root), { force: true });
+  applyActions(productLegacy, { force: true });
   // the Product, locally: the harness ledger guard, so an agent is refused the CI-owned ledger write at
   // the moment it tries it rather than by a failed pipeline later (#171). Verified-only like the CI
   // above — with no bridge the ledger is locally owned and the guard would be wrong.
   const hookWiring = hookActions(root, ideTargets);
   if (hookWiring.length) {
-    log(`  ${c.bold('hub')} ${c.dim('(agent ledger guard)')}`);
+    log(`  ${c.bold('product')} ${c.dim('(agent ledger guard)')}`);
     applyActions(hookWiring, { force: true });
     wired.push(...hookWiring);
   }
+  // E48: the same guard for a person's `git commit`, installed in this clone's git hooks. Not committed,
+  // so it is not pushed to `wired` (nothing to stage).
+  const gitHook = gitHookActions(root);
+  if (gitHook.length) {
+    log(`  ${c.bold('product')} ${c.dim('(git pre-commit ledger guard, this clone)')}`);
+    applyActions(gitHook, { force: true });
+  }
+  const gitHookNote = gitHookAdvice(gitHookState(root));
+  if (gitHookNote) warn(gitHookNote);
   // The post-edit capture hook (E43): every change to an artifact is snapshotted onto the person's private
   // `yad/wip/<name>/<epic>` branches. Both ledger modes; `"capture": false` in the Product config turns it off.
   const captureWiring = captureHookActions(root, ideTargets);
   if (captureWiring.length) {
-    log(`  ${c.bold('hub')} ${c.dim('(wip capture)')}`);
+    log(`  ${c.bold('product')} ${c.dim('(wip capture)')}`);
     applyActions(captureWiring, { force: true });
     wired.push(...captureWiring);
   }
+  // E113: the shell-script hooks a re-run replaces, once the entries above no longer name them.
+  const retiredHooks = legacyHookScriptActions(root, ideTargets);
+  if (retiredHooks.length) applyActions(retiredHooks, { force: true });
   // After every write to a managed path has landed (including the legacy renames), so the recorded
   // sha is the file's final state.
   recordManagedWrites(wired);
@@ -675,7 +736,12 @@ export const PACK_IGNORE_BLOCK = [
 // and returns true.
 export function ensurePackIgnored(root) {
   const gi = path.join(root, '.gitignore');
-  const lines = exists(gi) ? fs.readFileSync(gi, 'utf8').split('\n') : [];
+  // Only a plain file, or none: the Product can commit `.gitignore` as a link, and reading then writing
+  // through it would append this block to whatever file it points at, outside the workspace (E81 review 16).
+  let st = null;
+  try { st = fs.lstatSync(gi); } catch { /* none yet: written below */ }
+  if (st && !st.isFile()) { warn('.gitignore in the Product is not a plain file (a link?) — the code-context pack ignore line was not added'); return false; }
+  const lines = st ? fs.readFileSync(gi, 'utf8').split('\n') : [];
   if (lines.some((l) => l.trim() === PACK_IGNORE_GLOB)) return false;
   const body = lines.join('\n').replace(/\n*$/, '');
   const prefix = body ? `${body}\n\n` : '';
@@ -687,12 +753,15 @@ export function ensurePackIgnored(root) {
 export function packRepo(root, repo) {
   const repoRoot = path.resolve(root, repo.path);
   const out = path.join(root, repo.contextPack);
-  if (!has('npx')) { warn(`${repo.name}: npx missing — skipped repomix pack`); return false; }
+  // Printed through `forTerminal` (E81 review 12): the name and pack path come from the shared registry,
+  // and repomix's error line from a run in a registered folder.
+  const nm = forTerminal(repo.name);
+  if (!has('npx')) { warn(`${nm}: npx missing — skipped repomix pack`); return false; }
   fs.mkdirSync(path.dirname(out), { recursive: true });
   ensurePackIgnored(root); // keep the pack out of git before it is (re)written — see repo-publish.mjs invariant 1
-  info(`${repo.name}: packing with repomix …`);
-  const r = run('npx', ['repomix@latest', '--compress', '--include-logs', '--style', 'markdown', '-o', out], { cwd: repoRoot });
-  if (r.ok) { ok(`${repo.name}: cached ${repo.contextPack}`); hand(`${repo.name}: generate the code-map in your AI agent (yad-connect-repos)`); return true; }
-  fail(`${repo.name}: repomix failed — ${r.stderr.split('\n')[0] || 'unknown error'}`);
+  info(`${nm}: packing with repomix …`);
+  const r = runLauncher('npx', ['repomix@latest', '--compress', '--include-logs', '--style', 'markdown', '-o', out], { cwd: repoRoot });
+  if (r.ok) { ok(`${nm}: cached ${forTerminal(repo.contextPack)}`); hand(`${nm}: generate the code-map in your AI agent (yad-connect-repos)`); return true; }
+  fail(`${nm}: repomix failed — ${forTerminal(r.stderr.split('\n')[0]) || 'unknown error'}`);
   return false;
 }

package/cli/ship.mjs

@@ -28,7 +28,7 @@ export async function runShip(root, opts = {}) {
   // from the committed subject (the full `<type>: …` form), which the pr-title gate expects — passing
   // the bare --message here would override that with a type-less title and fail the gate.
   const opened = await runOpenPr(root, {
-    repo: opts.repo, platform: opts.platform, base: opts.base,
+    repo: opts.repo, product: opts.product, platform: opts.platform, base: opts.base,
     title: opts.title, task: opts.task,
     risk: opts.risk, contractChange: opts.contractChange,
   });

package/cli/skip.mjs

@@ -32,7 +32,7 @@ import { actorName } from './platform.mjs';
 // gate, so it must not block the verb.
 export function recordActor(root) {
   let platform = null;
-  try { platform = loadProduct(root)?.hub?.platform || null; } catch { /* no Product / malformed — attribute by raw git name */ }
+  try { platform = loadProduct(root)?.productConfig?.platform || null; } catch { /* no Product / malformed — attribute by raw git name */ }
   return actorName(root, platform);
 }
 
@@ -70,9 +70,9 @@ const VERBS = {
 // these verbs on a local ledger (`yad doctor` reports both), and the hook and the verb must give the same
 // answer on the same file.
 function ciOwnsLedger(root, { epic, command, undoCommand = null, runner }) {
-  const hub = readJSON(productConfigPath(root), null);
-  if (!isVerifiedLedger(hub)) return false;
-  const seeded = seededSlugs(root, hub, runner);
+  const productConfig = readJSON(productConfigPath(root), null);
+  if (!isVerifiedLedger(productConfig)) return false;
+  const seeded = seededSlugs(root, productConfig, runner);
   if (seeded === null) {
     warn(`this Product's ledger is verified, and origin could not be read — cannot tell whether CI already owns ${epicRel(epic)}/.sdlc/state.json. If the epic's first review PR has merged, ledger-guard will reject this change`);
     return false;

package/cli/tidy.mjs

@@ -13,7 +13,7 @@ import { productConfigPath } from './manifest.mjs';
 import { loadProduct } from './gate.mjs';
 import { platformLogin } from './platform.mjs';
 import { checkpointAuthor } from './checkpoint.mjs';
-import { productGit, resolveDefaultBranch, guardDefaultBranch } from './hubcommit.mjs';
+import { productGit, resolveDefaultBranch, guardDefaultBranch } from './productcommit.mjs';
 import { foldTrust, foldBuild } from './ledger.mjs';
 import { epicRoot, isValidEpicId, readFrontmatter } from './epic-state.mjs';
 
@@ -40,16 +40,16 @@ export async function runTidy(root, opts = {}) {
   log(c.bold('\nyad tidy up'));
   if (!exists(path.join(root, '.git'))) { fail('not a git repo'); process.exitCode = 1; return; }
   if (!exists(productConfigPath(root))) {
-    fail('no .sdlc/hub.json — run `yad tidy up` from the Product');
+    fail('no .sdlc/product.json — run `yad tidy up` from the Product');
     process.exitCode = 1;
     return;
   }
 
-  const { hub } = loadProduct(root);
+  const { productConfig } = loadProduct(root);
   const git = productGit(root);
   const branch = git('rev-parse', '--abbrev-ref', 'HEAD').stdout;
-  const defaultBranch = resolveDefaultBranch(git, hub);
-  if (!guardDefaultBranch(branch, defaultBranch, { allowBranch: opts.allowBranch, cmd: 'yad tidy up' })) return;
+  const defaultBranch = resolveDefaultBranch(git, productConfig);
+  if (!guardDefaultBranch(branch, defaultBranch, { allowBranch: opts.allowBranch, cmd: 'yad tidy up', root })) return;
 
   if (opts.epic && !isValidEpicId(opts.epic)) { fail(`invalid epic id '${opts.epic}'`); process.exitCode = 1; return; }
   if (opts.epic && !exists(epicRoot(root, opts.epic))) { fail(`no such epic '${opts.epic}'`); process.exitCode = 1; return; }
@@ -70,9 +70,9 @@ export async function runTidy(root, opts = {}) {
   }
   if (!folded) { info('nothing to tidy — no finished shards to fold'); return { folded: 0, epics: [], message: null, committed: false, pushed: false, dryRun: !!opts.dryRun }; }
 
-  const author = checkpointAuthor(platformLogin(root, hub?.platform), git('config', 'user.name').stdout);
+  const author = checkpointAuthor(platformLogin(root, productConfig?.platform), git('config', 'user.name').stdout);
   const label = touched.length === 1 ? touched[0] : `${touched.length} epics`;
-  const message = `chore(hub): tidy Build ledgers — ${label} by ${author} [skip ci]`;
+  const message = `chore(product): tidy Build ledgers — ${label} by ${author} [skip ci]`;
 
   if (opts.dryRun) {
     log('\n' + c.dim(message) + '\n');

package/cli/update-commit.mjs

@@ -21,18 +21,18 @@
 // Task trailer, no Co-Authored-By (human-owned machine state, not an authored code change).
 import fs from 'node:fs';
 import path from 'node:path';
-import { c, log, ok, info, warn, fail, hand, run, pushWithRebase } from './lib.mjs';
+import { c, log, ok, info, warn, fail, hand, run, pushWithRebase, samePath } from './lib.mjs';
 import { VERSION } from './manifest.mjs';
-import { productGit, resolveDefaultBranch } from './hubcommit.mjs';
+import { productGit, resolveDefaultBranch } from './productcommit.mjs';
 
 // Collapse whitespace/newline runs to a single space — keeps a stray path or hostile value from
 // breaking the one-line subject or injecting a fake trailer line.
 const oneLine = (s = '') => String(s).replace(/\s+/g, ' ').trim();
 
-// A short, human label for a repo root relative to the Product: 'hub' for the Product itself, else the
+// A short, human label for a repo root relative to the Product: 'product' for the Product itself, else the
 // registered path (e.g. demo-repos/backend), else the basename.
 export function repoLabel(productRoot, root) {
-  if (root === productRoot) return 'hub';
+  if (root === productRoot) return 'product';
   const r = path.relative(productRoot, root);
   return r && !r.startsWith('..') ? r.split(path.sep).join('/') : path.basename(root);
 }
@@ -92,25 +92,28 @@ function stageAllowlist(git, root, paths) {
 }
 
 // Commit (and, with push, push) one repo group. `defaultBranch` is the repo's configured default
-// (hub.default_branch / repo.default_branch); falls back to origin/HEAD then 'main'. Returns a small
+// (the Product's default_branch / repo.default_branch); falls back to origin/HEAD then 'main'. Returns a small
 // result object; never throws. On any hard error it sets process.exitCode so the CLI reports failure.
 export function commitAndPush(group, { push = false, allowBranch = false, productRoot, defaultBranch } = {}) {
   const { root, paths, items } = group;
   const label = repoLabel(productRoot ?? root, root);
+  // Whether this is the Product itself, from the folder — never from the label, which a repo named `product`
+  // shares (E124 review 1).
+  const isProduct = root === (productRoot ?? root);
   const git = productGit(root);
 
   // `root` must be the TOP of its OWN git repo — not merely "inside a work tree". A registered repo
   // whose clone is missing (reconcile's apply() happily recreates the wiring files) but whose path
-  // sits under the Product would otherwise report inside-work-tree=true against the HUB: git resolves the
-  // pathspecs relative to cwd, so we would stage the connected repo's files into the HUB's index and
-  // push them to the HUB's remote, mislabeled. Require the worktree top to BE this root.
+  // sits under the Product would otherwise report inside-work-tree=true against the Product: git resolves the
+  // pathspecs relative to cwd, so we would stage the connected repo's files into the Product's index and
+  // push them to the Product's remote, mislabeled. Require the worktree top to BE this root.
   const top = git('rev-parse', '--show-toplevel');
-  const sameRepo = top.ok && (() => {
-    try { return fs.realpathSync(top.stdout) === fs.realpathSync(root); } catch { return false; }
-  })();
+  // `samePath`, not a plain realpath compare: on Windows git's long name and Node's 8.3 short name for the
+  // same folder differed, and the repo was skipped with nothing committed.
+  const sameRepo = top.ok && samePath(top.stdout, root);
   if (!sameRepo) {
     warn(`${label}: not its own git repo (missing/renamed clone?) — skipped (changes left in the working tree)`);
-    return { label, committed: false, pushed: false, skipped: true, error: false };
+    return { label, product: isProduct, committed: false, pushed: false, skipped: true, error: false };
   }
   const branch = git('rev-parse', '--abbrev-ref', 'HEAD').stdout;
   const target = defaultBranch || resolveDefaultBranch(git);
@@ -120,13 +123,13 @@ export function commitAndPush(group, { push = false, allowBranch = false, produc
       warn(`${label}: on '${branch}', not default '${target}' — --allow-branch: commit/push go to origin/${branch}`);
     } else {
       warn(`${label}: on '${branch}', not the default branch '${target}' — skipped (switch to '${target}' or pass --allow-branch)`);
-      return { label, committed: false, pushed: false, skipped: true, error: false };
+      return { label, product: isProduct, committed: false, pushed: false, skipped: true, error: false };
     }
   }
 
   const { staged, addError } = stageAllowlist(git, root, paths);
   if (addError) warn(`${label}: git add reported "${addError}" — staging may be incomplete`);
-  if (!staged.length) { info(`${label}: nothing to commit (unchanged or ignored)`); return { label, committed: false, pushed: false, skipped: false, error: false }; }
+  if (!staged.length) { info(`${label}: nothing to commit (unchanged or ignored)`); return { label, product: isProduct, committed: false, pushed: false, skipped: false, error: false }; }
 
   // Pushing HEAD lands any local commits ahead of the remote too. Warn before we add ours so the
   // operator sees unpublished WIP about to ride the update push (never silently publish it).
@@ -142,18 +145,18 @@ export function commitAndPush(group, { push = false, allowBranch = false, produc
     git('reset', '-q', '--', ...staged); // don't leave our allowlist staged for an unrelated commit to sweep up
     fail(`${label}: git commit failed — ${cm.stderr.split('\n')[0] || cm.code}`);
     process.exitCode = 1;
-    return { label, committed: false, pushed: false, skipped: false, error: true };
+    return { label, product: isProduct, committed: false, pushed: false, skipped: false, error: true };
   }
   ok(`${label}: committed ${staged.length} file(s)`);
 
-  if (!push) return { label, committed: true, pushed: false, skipped: false, error: false };
-  if (pushWithRebase(root, branch).ok) { ok(`${label}: pushed to origin/${branch}`); return { label, committed: true, pushed: true, skipped: false, error: false }; }
+  if (!push) return { label, product: isProduct, committed: true, pushed: false, skipped: false, error: false };
+  if (pushWithRebase(root, branch).ok) { ok(`${label}: pushed to origin/${branch}`); return { label, product: isProduct, committed: true, pushed: true, skipped: false, error: false }; }
   // The commit already landed locally — a re-run of `yad update --push` would see no drift and skip
   // this repo, so point the operator at the direct push of the commit that already exists.
   fail(`${label}: could not push to origin/${branch} — a protected branch, or an unresolvable rebase conflict`);
-  hand(`resolve it in ${label === 'hub' ? '.' : label}, then push the existing commit with \`git push origin ${branch}\``);
+  hand(`resolve it in ${isProduct ? '.' : label}, then push the existing commit with \`git push origin ${branch}\``);
   process.exitCode = 1;
-  return { label, committed: true, pushed: false, skipped: false, error: true };
+  return { label, product: isProduct, committed: true, pushed: false, skipped: false, error: true };
 }
 
 // Orchestrate the per-repo commit/push over the grouped applied actions, bookended by the announce