yadflow 4.4.0 → 4.5.1

package/CHANGELOG.md

@@ -1,3 +1,40 @@
+## [4.5.1](https://github.com/abdelrahmannasr/yadflow/compare/v4.5.0...v4.5.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **docs:** a failed site build fails the Pages deploy ([32dd88f](https://github.com/abdelrahmannasr/yadflow/commit/32dd88f69dc1140977e1a2c126f94078aaa5f2ea))
+* **docs:** doctor judges only the failure handling, on the wired platform (review 2) ([987a753](https://github.com/abdelrahmannasr/yadflow/commit/987a7532951f61aec530550e2a9cab9aa4e0795f))
+* **docs:** escape the apostrophe that broke the overview site build ([fe7dcc8](https://github.com/abdelrahmannasr/yadflow/commit/fe7dcc81b2772dc577659e4afd2b85bec2bff81a))
+* **docs:** name every failed site, quote GitLab lines as YAML, doctor warns on an old wired workflow (review 1) ([d525e87](https://github.com/abdelrahmannasr/yadflow/commit/d525e87961413a10ba16122dfc3811ac3d5361a7))
+* **gitlab:** check the git-lfs download against its SHA-256 ([#327](https://github.com/abdelrahmannasr/yadflow/issues/327) review 1) ([01763a2](https://github.com/abdelrahmannasr/yadflow/commit/01763a25fdc47eea298592f3ab453341c2c14196))
+* **gitlab:** install git-lfs in yad-gate-sync when the Product uses LFS ([#327](https://github.com/abdelrahmannasr/yadflow/issues/327)) ([fcb55fb](https://github.com/abdelrahmannasr/yadflow/commit/fcb55fb6a3c2d96be067cb7c027644424784181d))
+* **windows:** leave the npm launcher name unquoted so npx finds itself ([#326](https://github.com/abdelrahmannasr/yadflow/issues/326)) ([b042848](https://github.com/abdelrahmannasr/yadflow/commit/b0428484f371a03cc5e722158481faf51004b519))
+
+# [4.5.0](https://github.com/abdelrahmannasr/yadflow/compare/v4.4.0...v4.5.0) (2026-10-06)
+
+
+### Bug Fixes
+
+* **member:** E131 review 1 — links, twins, proof and pushes ([1179a97](https://github.com/abdelrahmannasr/yadflow/commit/1179a9731e4ff9f8d6b80f5aed82d5809bde5ed2))
+* **member:** E131 review 2 — gate-live trust, account ids, clean-ups ([74d41f6](https://github.com/abdelrahmannasr/yadflow/commit/74d41f65a585fdf06639be87688f69353eb61916))
+* **member:** E131 review 3 — trust only files the gate judged ([2f9af14](https://github.com/abdelrahmannasr/yadflow/commit/2f9af141e524ca7daacbce8c2799f56c72c6d75e))
+* **member:** E131 review 4 — trust is read from origin's default branch ([43af9c4](https://github.com/abdelrahmannasr/yadflow/commit/43af9c4565c3bbfae7042d7765df62150fa64447))
+* **member:** E131 review 5 — every change re-proves every email ([041937c](https://github.com/abdelrahmannasr/yadflow/commit/041937c936f5d9f29683ef6f9d4cc6fb93ad83bd))
+* **member:** E131 review 6 — re-runs, origin/HEAD, partial lists ([e9bad00](https://github.com/abdelrahmannasr/yadflow/commit/e9bad002eff766705d193b1515baa3d39ae0c360))
+* **standup:** E132 review 1 — gate rule, malformed ledgers, terminal safety ([a0e7d47](https://github.com/abdelrahmannasr/yadflow/commit/a0e7d4750e7b485582cded4b55dfcc212013a101))
+* **standup:** E132 review 2 — missed twins of round 1 ([ba1ce61](https://github.com/abdelrahmannasr/yadflow/commit/ba1ce61b961decbea46298b714fd33f811fb264a))
+* **standup:** E132 review 3 — paths, disputed accounts, left members ([add86cc](https://github.com/abdelrahmannasr/yadflow/commit/add86cca821ab29afa79838734a3b83621dd2330))
+* **standup:** E132 review 4 — Windows paths, a name is plain text ([435225f](https://github.com/abdelrahmannasr/yadflow/commit/435225f48a21fe8a850ba65c0c7f1315df6bbb1e))
+* **standup:** E132 review 5 — path names in square brackets ([7ac3cb2](https://github.com/abdelrahmannasr/yadflow/commit/7ac3cb265c309f0e707e6dae32076796a5e2c240))
+
+
+### Features
+
+* **join:** E131 join ends with yad member add ([3295429](https://github.com/abdelrahmannasr/yadflow/commit/3295429092b549707a03eecacddc50d15d1df77a))
+* **member:** E131 team member files, proven by the platform ([3e60bb6](https://github.com/abdelrahmannasr/yadflow/commit/3e60bb62bb2edb467be4d5f8562b9fe1bac6ca0a))
+* **standup:** yad standup — a daily status per team member (E132) ([00f32ce](https://github.com/abdelrahmannasr/yadflow/commit/00f32ce742166e8b82e796b3eef85b379edd4cee))
+
 # [4.4.0](https://github.com/abdelrahmannasr/yadflow/compare/v4.3.0...v4.4.0) (2026-10-03)
 
 

package/README.md

@@ -144,7 +144,7 @@ unless CI runs it), or `yad gate advance` with no platform, is the human decisio
 | --- | --- | --- |
 | Existing repositories | `yad init`, in the folder that holds them | Run the `yad-backfill` skill first. It records what already exists. |
 | One existing repository with all the code | `yad setup --brownfield --monorepo`, inside it | The same: run `yad-backfill` first. |
-| A team that already uses Yadflow | `yad join <Product clone URL>` | It clones the Product and every repository it lists. It sets up only this machine and never commits. |
+| A team that already uses Yadflow | `yad join <Product clone URL>` | It clones the Product and every repository it lists and sets up this machine. Last, it records you as a team member (`yad member add`): your accounts and verified emails, on a branch of its own with its own pull request. |
 
 **Small changes.** Not every change needs the full route:
 
@@ -256,6 +256,7 @@ The record is worth trusting because people approve what goes into it.
 - the Shape and Build steps with review gates
 - linked changes and `yad thread`
 - `yad history`, `yad next` and `yad usage`
+- `yad standup`, a daily status for each team member — what they did since the last working day, what they are on now, and what is waiting — rebuilt live from git, the ledgers and the platform, facts only
 - `yad detect`, which lists the skills, agents, MCP servers and plugins installed for each AI agent
 - `yad toolbox list`, which shows the external tools yadflow can use, which ones you have, and what happens without each; `yad toolbox add` / `remove` record the tools your team uses, and `yad toolbox check` lists the ones not ready on your machine (`yad setup`, `check`, `update` and `join` print the same list, and never install anything); each skill that uses a tool reads the same answer and says what it does without it
 - `yad skill recommend`, which lists hand-picked skills from the recommended skill collections for each step, why each fits, and the command to bind one; it binds nothing, and every pick was checked against its source

package/bin/commands.mjs

@@ -29,6 +29,8 @@ export { runCapture } from '../cli/capture.mjs';
 export { runFold } from '../cli/fold.mjs';
 export { runClaims } from '../cli/claims.mjs';
 export { runAssign, runUnassign, runOwners } from '../cli/owners.mjs';
+export { runMemberAdd, runMemberList, runMemberRemove } from '../cli/members.mjs';
+export { runStandup, foreignFlags as standupForeignFlags } from '../cli/standup.mjs';
 export { runIndex } from '../cli/index-command.mjs';
 export { runHistory, HISTORY_FLAGS } from '../cli/history.mjs';
 export { runRepo } from '../cli/repo.mjs';

package/bin/yad.mjs

@@ -21,7 +21,8 @@ ${c.bold('Start a workspace')} ${c.dim('(the folder holding product/ and the cod
                        Clone the Product into [folder]/product/ (default: the URL's last name) and
                        every repo it registers; a failed repo clone is reported, never fatal. Then
                        only per-machine steps: git-ignored skill copies + the git pre-commit hook.
-                       Never commits, pushes, or changes a shared file
+                       Last, \`yad member add\` (below): your member file, on a branch with its own
+                       PR/MR — the only shared change join makes. A problem there never fails join
 
 ${c.bold('Setup & maintenance')}
   yad setup            Guided first-run setup (profile interview, install, connect & wire repos,
@@ -68,6 +69,31 @@ ${c.bold('Setup & maintenance')}
                        installs in this clone refuses a person's hand commit to the ledger.
                        YAD_HOOK_DISABLE=1 skips.
 
+${c.bold('Team members')} ${c.dim('(identity only — no roles, no reviewers, no allowlist)')}
+  yad member add [--no-push]           Prove who you are and write .sdlc/members/<platform>-<login>.json:
+                                       your account on the Product's platform (logs you in if needed),
+                                       your other GitHub/GitLab accounts and git emails that the platform
+                                       says are VERIFIED (stored hashed). One commit per email on
+                                       yad/member/<login>, pushed, with a PR/MR. Never your checkout
+  yad member list [--json]             Every member: active (committed or approved within the TTL,
+                                       default 90 days), idle (quiet, still has access), left (the
+                                       platform says no access — off the team list) or unknown
+  yad member remove [<login>] [--reason <why>]
+                                       Delete a member file — your own, or anyone's with --reason
+
+${c.bold('Daily standup')} ${c.dim('(derived live, read-only, facts only — no score, no ranking)')}
+  yad standup                          Each member on the team list: done since the last standup
+                                       (commits, approvals, comments, closed steps, ships, merged
+                                       PRs/MRs), working on now (owned steps, open claims, drafts, open
+                                       PRs/MRs) and waiting (gates on their steps, their next move, their
+                                       PRs/MRs with failing checks or no approving review). Then the
+                                       people seen who are not on the list, and who has left.
+                                       Window: from midnight of the previous working day (Monday reads
+                                       back to Friday). Asks the platform about the Product and every
+                                       registered repo; one it cannot read says "platform not read"
+                                       flags: --since <YYYY-MM-DD>|<N>h|<N>d, --tz <zone> (default UTC),
+                                       --member <login> | --me, --format md|html, --out <file>, --json
+
 ${c.bold('Team usage (EM adoption & behavior report)')}
   yad usage                            Build a per-member report (HTML) from git + the SDLC ledgers
                                        (derived, read-only — writes no tracked state)
@@ -349,7 +375,9 @@ ${c.bold('Environment')}
   YAD_NO_REPORT=1            Never offer to file a bug report after a failure
   YAD_PLATFORM_LOGIN=0       Name a record's author by git user.name; never ask gh/glab who is logged in`;
 
-const VALUE_FLAGS = new Set(['--dir', '--type', '--message', '--task', '--ai', '--risk', '--repo', '--platform', '--base', '--title', '--scope', '--branch', '--pr', '--epic', '--team', '--body', '--out', '--since', '--until', '--member', '--format', '--reason', '--profile', '--parent', '--inherits', '--to', '--retro-ship', '--merge-commit', '--path', '--ide-targets', '--theme', '--thread', '--by', '--count', '--engagement', '--keep', '--role', '--fallback', '--detect', '--install', '--source']);
+const STANDUP_USAGE = 'usage: yad standup [--since <YYYY-MM-DD>|<N>h|<N>d] [--tz <zone>] [--member <login>|--me] [--format md|html] [--out <file>] [--json]';
+
+const VALUE_FLAGS = new Set(['--dir', '--type', '--message', '--task', '--ai', '--risk', '--repo', '--platform', '--base', '--title', '--scope', '--branch', '--pr', '--epic', '--team', '--body', '--out', '--since', '--until', '--member', '--format', '--reason', '--profile', '--parent', '--inherits', '--to', '--retro-ship', '--merge-commit', '--path', '--ide-targets', '--theme', '--thread', '--by', '--count', '--engagement', '--keep', '--role', '--fallback', '--detect', '--install', '--source', '--tz']);
 
 function parseArgs(argv) {
   const o = { _: [], dir: process.cwd(), fix: false, force: false, scope: 'all' };
@@ -360,6 +388,7 @@ function parseArgs(argv) {
     else if (a === '--force') o.force = true;
     else if (a === '--contract-change') o.contractChange = true;
     else if (a === '--manual') o.manual = true;
+    else if (a === '--me') o.me = true;
     else if (a === '--no-push') o.noPush = true;
     else if (a === '--no-fetch') o.noFetch = true;
     else if (a === '--push') o.push = true;
@@ -447,6 +476,7 @@ const ACTIONS = {
   reconcile: { known: ['check', 'refresh', 'wire'] },
   hook: { known: ['ledger-guard'] },
   toolbox: { known: ['list', 'check', 'add', 'remove'], default: 'list' },
+  member: { known: ['add', 'list', 'remove'], default: 'list' },
 };
 // E80 — how each command finds its folder. A PRODUCT command works on the Product; a REPO command works
 // on the code repo it runs in and reads the Product beside it. The rest take their folder as given:
@@ -455,7 +485,7 @@ const PRODUCT_CMDS = new Set([
   'check', 'update', 'doctor', 'migrate', 'usage', 'sync-status', 'epic', 'foundation', 'skill', 'next',
   'skip', 'unskip', 'defer', 'undefer', 'dial', 'mode', 'kill', 'unkill', 'unblock', 'gate', 'checkpoint',
   'capture', 'claims', 'assign', 'unassign', 'owners', 'fold', 'tidy', 'index', 'history', 'repo',
-  'risk-map', 'codeowners', 'docs', 'thread', 'reconcile',
+  'risk-map', 'codeowners', 'docs', 'thread', 'reconcile', 'member', 'standup',
 ]);
 const REPO_CMDS = new Set(['commit', 'open-pr', 'ship', 'review']);
 // The Product commands that WRITE its files without first checking it is one. Run from a code repo they
@@ -468,6 +498,7 @@ function writesProduct(cmd, o) {
   if (cmd === 'epic' || cmd === 'foundation') return action === 'new';
   if (cmd === 'skill') return action === 'bind' || action === 'unbind';
   if (cmd === 'dial') return o.to !== undefined;
+  if (cmd === 'member') return o._[1] === 'add' || o._[1] === 'remove';
   // `--wire` writes a CI workflow; `--refresh` only rebuilds sites the folder already holds.
   if (cmd === 'docs') return action === 'sync' && !!o.wire;
   return false;
@@ -887,6 +918,30 @@ async function main() {
       if (o.hook) process.exitCode = 0;
       break;
     }
+    case 'member': {
+      // E131. One file per person, identity only.
+      const [, action = 'list', who, extra] = o._;
+      const usage = 'usage: yad member add [--no-push] | yad member list [--json] | yad member remove [<login>] [--reason "<why>"]';
+      if (!['add', 'list', 'remove'].includes(action)) { refuse(`unknown member action: ${action} (add, list, remove)`, usage); break; }
+      if ((action !== 'remove' && who) || extra) { refuse(`unexpected word: ${extra || who}`, usage); break; }
+      if (noProduct()) break;
+      if (action === 'add') result = await commands.runMemberAdd(o.dir, { noPush: !!o.noPush, today });
+      else if (action === 'list') result = await commands.runMemberList(o.dir, { today });
+      else result = await commands.runMemberRemove(o.dir, { login: who ?? null, reason: o.reason ?? null });
+      break;
+    }
+    case 'standup': {
+      // E132. Read-only; every flag that is not standup's own is refused, as history refuses them.
+      const foreign = commands.standupForeignFlags(process.argv.slice(2));
+      if (foreign.length) { refuse(`yad standup does not take ${foreign.join(', ')}`, STANDUP_USAGE); break; }
+      if (o._[1]) { refuse(`yad standup takes no words (got: ${o._[1]})`, STANDUP_USAGE); break; }
+      if (noProduct()) break;
+      result = await commands.runStandup(o.dir, {
+        since: o.since ?? null, tz: o.tz ?? 'UTC', member: o.member ?? null, me: !!o.me,
+        format: o.format ?? null, out: o.out ?? null, json: !!o.json,
+      });
+      break;
+    }
     case 'claims': {
       // E46. Read from the capture branches; nothing is recorded here.
       const [, epic, extra] = o._;

package/cli/claims.mjs

@@ -135,6 +135,21 @@ export function claimWarnings(root, changed, { env = process.env, now = Date.now
 }
 export const warningText = (hits, now) => `yad claims: ${hits.length === 1 ? 'this file is' : 'these files are'} also being edited by someone else — advice, not a lock; talk to them before you go further:\n${hits.map((c) => `  • ${claimLine(c, now)}`).join('\n')}`;
 
+// Fetch everyone's capture branches and the default branch: 'done' | 'failed' | 'local' (no origin). One
+// fetch, 30 seconds at most. `yad claims` and `yad standup` (E132) both read what it brings.
+export function fetchCaptures(root, env = process.env) {
+  const git = gitIn(root, env);
+  if (!git(['remote', 'get-url', 'origin']).ok) return 'local';
+  const opts = { cwd: root, encoding: 'utf8', timeout: 30_000, env: { ...env, ...pushEnv(env) } };
+  const r = spawnSync('git', fetchAllArgs({ prune: true }), opts);
+  const fetched = r.status === 0 ? 'done' : 'failed';
+  // The default branch, for the "landed" rule — on its own: a name guessed wrong (no Product default, no
+  // origin/HEAD) must not stop the capture branches from arriving. Its failure changes nothing.
+  const def = defaultRef(root, git).name;
+  if (fetched === 'done') spawnSync('git', ['-c', 'http.lowSpeedLimit=1000', '-c', 'http.lowSpeedTime=20', 'fetch', '--quiet', '--no-tags', 'origin', `+refs/heads/${def}:refs/remotes/origin/${def}`], opts);
+  return fetched;
+}
+
 // `yad claims [<epic>] [--no-fetch]`. Returns a plain object (E1 makes it the `--json` answer).
 export async function runClaims(root, { epic = null, noFetch = false, env = process.env, now = Date.now() } = {}) {
   const refuse = (msg, hint) => { fail(msg); if (hint) hand(hint); process.exitCode = 1; };
@@ -142,19 +157,7 @@ export async function runClaims(root, { epic = null, noFetch = false, env = proc
   if (!git(['rev-parse', '--show-toplevel']).ok) return refuse('not a git repository — there are no capture branches to read');
   if (!fs.existsSync(productConfigPath(root))) return refuse('not a Product (no .sdlc/hub.json or product.json here)', 'run it from the Product root, or pass --dir');
   if (epic && !/^EP-[a-z0-9-]+$/.test(epic)) return refuse(`not an epic id: ${epic}`);
-  let fetched = 'skipped';
-  if (!noFetch) {
-    if (!git(['remote', 'get-url', 'origin']).ok) fetched = 'local';
-    else {
-      const opts = { cwd: root, encoding: 'utf8', timeout: 30_000, env: { ...env, ...pushEnv(env) } };
-      const r = spawnSync('git', fetchAllArgs({ prune: true }), opts);
-      fetched = r.status === 0 ? 'done' : 'failed';
-      // The default branch, for the "landed" rule — on its own: a name guessed wrong (no Product default, no
-      // origin/HEAD) must not stop the capture branches from arriving. Its failure changes nothing.
-      const def = defaultRef(root, git).name;
-      if (fetched === 'done') spawnSync('git', ['-c', 'http.lowSpeedLimit=1000', '-c', 'http.lowSpeedTime=20', 'fetch', '--quiet', '--no-tags', 'origin', `+refs/heads/${def}:refs/remotes/origin/${def}`], opts);
-    }
-  }
+  const fetched = noFetch ? 'skipped' : fetchCaptures(root, env);
   if (fetched === 'local') info('no remote named origin — only your own captures can be read here');
   if (fetched === 'failed') warn('could not fetch the capture branches — showing what was last fetched, which may be old');
   const { claims, defaultBranch } = readClaims(root, { env, now, epics: epic ? new Set([epic]) : null });

package/cli/docs.mjs

@@ -144,12 +144,28 @@ export function docsStale(manifest, { artifactHash, repoHeads = {}, shellVersion
 // mounts under `app/`, and every per-epic site nests under `epics/<id>/` — matching siteBasePath
 // (overview at `<base>/app/`, epics at `<base>/epics/EP-<slug>/`). A concurrency group prevents the
 // deploy from retriggering. The shared shell script keeps the two platforms byte-for-byte aligned.
+// A site that fails to build fails the run: CI runs the script under `set -e`, which does not stop on a
+// failure inside an `&&` chain, so a failed site used to be silently left out while the deploy still went
+// green — yadflow's own site lost its root page that way for days. Each chain ends in `|| failed=…`, so
+// every site is still tried (as `yad docs build` does) and the last line fails the run, naming them all.
+// A red run uploads nothing, so the last good deployment stays live.
+// A YAML single-quoted scalar: a quote inside is written twice, and nothing else is escaped (a backslash
+// is literal). The shell's '\'' is not YAML — it would make GitLab reject the whole pipeline.
+export const yamlQuoted = (s) => `'${String(s).replace(/'/g, "''")}'`;
+const PAGES_FAIL_LINE = 'yad-docs: these sites did not build, so nothing is deployed:';
 const BUILD_PUBLIC = [
   'mkdir -p public',
-  'if [ -d docs/sdlc-site ]; then (cd docs/sdlc-site && npm ci && npm run build) && mkdir -p public/app && cp -r docs/sdlc-site/dist/. public/app/ && cp docs/sdlc-site/public/report.html public/index.html && cp docs/sdlc-site/public/report.html public/report.html; fi',
-  'if [ -d docs/tutorial-site ]; then (cd docs/tutorial-site && npm ci && npm run build) && mkdir -p public/tutorial && cp -r docs/tutorial-site/dist/. public/tutorial/; fi',
-  'for d in epics/*/docs-site; do [ -d "$d" ] || continue; id=$(basename "$(dirname "$d")"); (cd "$d" && npm ci && npm run build) && mkdir -p "public/epics/$id" && cp -r "$d/dist/." "public/epics/$id/"; done',
+  'failed=',
+  'if [ -d docs/sdlc-site ]; then (cd docs/sdlc-site && npm ci && npm run build) && mkdir -p public/app && cp -r docs/sdlc-site/dist/. public/app/ && cp docs/sdlc-site/public/report.html public/index.html && cp docs/sdlc-site/public/report.html public/report.html || failed="$failed docs/sdlc-site"; fi',
+  'if [ -d docs/tutorial-site ]; then (cd docs/tutorial-site && npm ci && npm run build) && mkdir -p public/tutorial && cp -r docs/tutorial-site/dist/. public/tutorial/ || failed="$failed docs/tutorial-site"; fi',
+  'for d in epics/*/docs-site; do [ -d "$d" ] || continue; id=$(basename "$(dirname "$d")"); (cd "$d" && npm ci && npm run build) && mkdir -p "public/epics/$id" && cp -r "$d/dist/." "public/epics/$id/" || failed="$failed $d"; done',
+  `if [ -n "$failed" ]; then echo "${PAGES_FAIL_LINE}$failed" >&2; exit 1; fi`,
 ];
+// The platform `--wire` writes for: the Product's docs target, GitHub unless it says GitLab.
+export const wiredPagesPlatform = (docs) => (docs?.target === 'gitlab-pages' ? 'gitlab' : 'github');
+// Does a wired Pages workflow fail its deploy when a site fails to build? Read by `yad doctor`. Only this
+// line is looked for — not the whole file — so a Dependabot pin bump or an edit elsewhere is not news.
+export const pagesWorkflowFailsOnBuild = (text) => text.includes(PAGES_FAIL_LINE);
 export function pagesWorkflow(platform) {
   if (platform === 'gitlab') {
     return `# yad-managed — built by \`yad docs sync --wire\`. include it from .gitlab-ci.yml:
@@ -161,7 +177,7 @@ pages:
   rules:
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   script:
-${BUILD_PUBLIC.map((l) => `    - '${l.replace(/'/g, "'\\''")}'`).join('\n')}
+${BUILD_PUBLIC.map((l) => `    - ${yamlQuoted(l)}`).join('\n')}
   artifacts:
     paths: [public]
   resource_group: pages
@@ -347,7 +363,7 @@ function reportFreshness(root, t) {
 }
 
 function wirePages(root, docs) {
-  const platform = docs?.target === 'gitlab-pages' ? 'gitlab' : 'github';
+  const platform = wiredPagesPlatform(docs);
   const rel = pagesWorkflowPath(platform);
   const dest = path.join(root, rel);
   fs.mkdirSync(path.dirname(dest), { recursive: true });

package/cli/doctor.mjs

@@ -22,9 +22,11 @@ import { checkCodeowners, codeownersFindings } from './codeowners-command.mjs';
 import { RISK_MAP_FILE } from './riskmap.mjs';
 import { readProtection, protectionLine, protectionJSON, hideAddresses } from './protection.mjs';
 import { soloTeamHint, TEAM_CMD } from './people.mjs';
+import { pagesWorkflowPath, pagesWorkflowFailsOnBuild, wiredPagesPlatform } from './docs.mjs';
 import { indexFreshness, INDEX_FILE } from './product-index.mjs';
 import { productGit, resolveDefaultBranch } from './productcommit.mjs';
 import { readOwners } from './owners.mjs';
+import { readMembers, judgedMemberFiles } from './members.mjs';
 import { loadChoices, readToolboxFile } from './toolbox.mjs';
 
 // A registered path doctor may run git in (E81): a checkout the judgement accepts — never a refused
@@ -378,6 +380,7 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
   // Background capture (E43), on any Product in either ledger mode: is the post-edit hook wired, and will
   // a push to the `yad/wip/*` branches start the team's own CI?
   if (exists(productPath)) captureChecks(root, checks, readJSON(productPath, null));
+  docsWorkflowChecks(root, checks);
   if (exists(productPath)) lineEndingChecks(root, checks);
 
   // design.json: parse + shape + tool + MCP confirmation (absent is the normal markdown-only default —
@@ -1889,6 +1892,37 @@ export function ownerChecks(checks, root) {
     'such a file is ignored — no owner is shown and the edit-time warning is off. For a step on the chain, `yad assign <epic> <step> --force` replaces it and `yad unassign <epic> <step> --force` removes it; for any other, delete it (`git rm <path>`). `yad owners` lists them all');
 }
 
+// `members:*` (E131). A member file that cannot be used, or an account or email two files share, pairs
+// nothing — the person it was meant to join counts twice, and nobody is told anywhere else. And where no
+// CI runs (a local ledger, no platform), nothing checks a member file: say that it is its owner's statement.
+export function memberChecks(checks, root) {
+  let got;
+  try { got = readMembers(root); } catch { return; }
+  const some = (list) => `${list.slice(0, 3).join('; ')}${list.length > 3 ? ` (+${list.length - 3} more)` : ''}`;
+  if (got.errors.length) {
+    check(checks, 'members:unreadable', 'project', 'warn', `${got.errors.length} member file(s) pair nothing: ${some(got.errors.map((e) => e.error))}`,
+      'such a file joins no email to any login, so its person counts twice and is not on the team list. Its owner runs `yad member add` to write it again; otherwise delete it (`yad member remove <login> --reason …`)');
+  }
+  if (got.duplicates.length) {
+    check(checks, 'members:duplicate', 'project', 'warn', `an account or email is in two member files: ${some(got.duplicates)}`,
+      'one account and one email belong to one member. Until one file is fixed, neither file joins it. On a verified Product the member-check gate refuses the PR that adds the second');
+  }
+  // Which files the gate COUNT leaves out, and why (review 3): no live gate, or a file the gate never judged.
+  if (got.members.length && got.identity.verified && got.identity.platform === 'github') {
+    const judged = judgedMemberFiles(root, got.identity);
+    const left = got.members.filter((m) => !judged.files.has(m.rel)).map((m) => m.rel);
+    if (left.length) {
+      check(checks, 'members:untrusted', 'project', 'warn', `${left.length} member file(s) are not used by the active-people count: ${left.slice(0, 3).join('; ')}${left.length > 3 ? ` (+${left.length - 3} more)` : ''}`,
+        judged.live ? 'no gate as shipped judged them: each was last changed before the member-check gate or its workflow last changed on origin\'s default branch (every `yad update` that changes either resets this), or differs here from origin — its owner runs `yad member add` again, and that change is judged'
+          : 'the member-check gate or its workflow on origin\'s default branch is missing, edited, or from another yadflow version than this one — `yad update` installs the shipped copies, then each member runs `yad member add` again');
+    }
+  }
+  if (got.members.length && !got.identity.verified) {
+    check(checks, 'members:unchecked', 'project', 'ok', `${got.members.length} member file(s), and no CI checks them on this Product`,
+      'with a local ledger or no platform, no member-check gate runs, so each member file is its owner\'s own statement');
+  }
+}
+
 // The installed gates whose changed list must name a rename by both paths (E114), and the test for one
 // that does not. Read as bash reads it, one command at a time, so one fixed command never hides its blind
 // twin: a `#` line is prose and is dropped FIRST (a `\` at its end does not go on); then a line ending in
@@ -2563,6 +2597,7 @@ export function collectDoctor(root, { headCount = null } = {}) {
   skipChecks(checks, root);
   stepStateChecks(checks, root);
   ownerChecks(checks, root);
+  memberChecks(checks, root);
   ownerGuardChecks(checks, root);
   renamedChecks(checks, root);
   productProfileChecks(checks, root);
@@ -2664,6 +2699,21 @@ export function captureChecks(root, checks, cfg) {
   }
 }
 
+// The Pages workflow `yad docs sync --wire` wrote. Nothing else rewrites it, so a Product wired by yadflow
+// 4.5.0 or older keeps a script that deploys a site with a page missing when a site fails to build. Only
+// that one behaviour is judged — not the whole file, which Dependabot bumps and a team may edit — and only
+// in the file `--wire` writes for this Product's platform (it never touches the other one). A file
+// without our header is the team's own.
+export function docsWorkflowChecks(root, checks) {
+  const rel = pagesWorkflowPath(wiredPagesPlatform(readJSON(path.join(root, PROJECT_FILES.docsConfig), null)));
+  let text;
+  try { text = fs.readFileSync(path.join(root, rel), 'utf8'); } catch { return; }
+  if (!text.startsWith('# yad-managed — built by `yad docs sync --wire`')) return;
+  if (pagesWorkflowFailsOnBuild(text)) check(checks, 'docs-workflow', 'project', 'ok', `${rel} fails the deploy when a site fails to build`);
+  else check(checks, 'docs-workflow', 'project', 'warn', `${rel} still deploys when a site fails to build — the site then goes out with a page missing`,
+    'run `yad docs sync --wire` and commit the file; it rewrites the whole file, so re-apply any change your team made to it');
+}
+
 // The team's own GitHub workflow files that a push to a `yad/wip/*` branch would start. A line reader, not
 // a YAML parser, confined to the TOP-LEVEL `on:` block (a job named `push` is not a trigger). It reads the
 // usual spellings — `on: push`, `on: [push, …]`, and a `push:` key under `on:` — and decides the way

package/cli/lib.mjs

@@ -357,11 +357,14 @@ export function run(cmd, args = [], opts = {}) {
 export const has = (cmd) => run(process.platform === 'win32' ? 'where' : 'which', [cmd]).ok;
 
 // An npm launcher (`npm`, `npx`) is a `.cmd` file on Windows, which Node will not start without a shell
-// (since 18.20.2) — a plain spawn fails with EINVAL there. So on Windows it runs through one, each word in
+// (since 18.20.2) — a plain spawn fails with EINVAL there. So on Windows it runs through one, each argument in
 // double quotes (a Windows path cannot hold a `"`); everywhere else it is spawned directly (E113).
+// The launcher name itself stays bare: a `.cmd` found on PATH through a QUOTED name reads `%~dp0` as the
+// current folder, so `"npx"` looked for npx-cli.js inside the repo being packed (#326). Callers pass a
+// fixed name (`npm`, `npx`), never user input.
 export function launcherInvocation(cmd, args, platform = process.platform) {
   if (platform !== 'win32') return { cmd, args, shell: false };
-  return { cmd: [cmd, ...args].map((a) => `"${String(a).replace(/"/g, '')}"`).join(' '), args: [], shell: true };
+  return { cmd: [cmd, ...args.map((a) => `"${String(a).replace(/"/g, '')}"`)].join(' '), args: [], shell: true };
 }
 export function runLauncher(cmd, args = [], opts = {}) {
   const inv = launcherInvocation(cmd, args);

package/cli/manifest.mjs

@@ -539,6 +539,9 @@ export const PRODUCT_WIRING = {
     { src: 'skills/yad-checks/templates/checks/commit-message.sh', dest: 'checks/commit-message.sh', exec: true },
     { src: 'skills/yad-pr-template/templates/checks/pr-title.sh', dest: 'checks/pr-title.sh', exec: true },
     { src: 'skills/yad-pr-template/templates/checks/pr-template.sh', dest: 'checks/pr-template.sh', exec: true },
+    // E131: a member file is changed only by its own person, and each email it adds is proven on the PR.
+    // A Node script (`node checks/member-check.mjs`), so it needs no execute bit.
+    { src: 'skills/yad-checks/templates/checks/member-check.mjs', dest: 'checks/member-check.mjs' },
   ],
   github: [
     { src: 'skills/yad-product-bridge/templates/github/yad-gate-sync.yml', dest: '.github/workflows/yad-gate-sync.yml' },