diff --git a/.agents/skills/workflow-ci-contract/SKILL.md b/.agents/skills/workflow-ci-contract/SKILL.md index 21a144bb..9cf6432d 100644 --- a/.agents/skills/workflow-ci-contract/SKILL.md +++ b/.agents/skills/workflow-ci-contract/SKILL.md @@ -1,7 +1,7 @@ --- name: workflow-ci-contract description: >- - Governs the WORKFLOW.md CI/CD behavioral contract for every ptr727/ProjectTemplate fleet repo: the D1-D9 guarantees stated as the failure mode each prevents, the seam contract for release assets, the artifact lifecycle, NBGV versioning and classification, validate-at-entry, and the 5A/5B/5C test methodology with its per-type walkthroughs. Use this whenever writing or editing anything under .github/workflows/, adding or dropping a release target, auditing a repo's workflows, or reasoning about why a publish did or did not fire. This is the YAML half of the pipeline, and the operational-vs-release-workflow skill keeps the git half (branching, promotion, publish policy), so branch choice questions go there. Triggers even when the edit looks mechanical, such as bumping an action, renaming a job, or adding one upload step, because SHA pinning, the ruleset-bound aggregator name, smoke gating on uploads, and retention-days are each easy to break in a one-line diff that no smoke build exercises, since workflow-only changes are deliberately not smoke-built. WORKFLOW.md keeps authority, and GOVERNANCE.md wins where the two overlap. + Governs the WORKFLOW.md CI/CD behavioral contract for every ptr727/ProjectTemplate fleet repo: the D1-D9 guarantees, the seam contract for release assets, the artifact lifecycle, NBGV versioning and classification, validate-at-entry, and the 5A/5B/5C test methodology with its per-type walkthroughs. Use this whenever writing or editing anything under .github/workflows/, adding or dropping a release target, auditing a repo's workflows, or reasoning about why a publish did or did not fire. This is the YAML half of the pipeline, and the operational-vs-release-workflow skill keeps the git half (branching, promotion, publish policy), so branch choice questions go there. Triggers even when the edit looks mechanical, such as bumping an action, renaming a job, or adding one upload step, because SHA pinning, the ruleset-bound aggregator name, smoke gating on uploads, and retention-days are each easy to break in a one-line diff that no smoke build exercises, since workflow-only changes are deliberately not smoke-built. WORKFLOW.md keeps authority, and GOVERNANCE.md wins where the two overlap. --- # Workflow CI Contract @@ -40,7 +40,7 @@ description: >- - **No-op republish**: an unchanged version re-pushes nothing, the release-create step skips when the tag exists and is refreshed only on a dispatch, registries dedupe server-side (`--skip-duplicate`, `skip-existing: true`), and Docker alone always re-pushes by design. - **A build failure blocks every publish target**: `github-release` needs every build and guards with `!failure() && !cancelled()` as the terminal registry pusher (Docker) does, and a package target's separate `publish-` job `needs:` the release-task call, so no build failure ships anything partial. A failed package push is outside that, since it runs after the release is cut. -The full catalog, each guarantee with the failure mode it prevents, is in `references/d-guarantees.md`. Auditing, tracing, and probing a repo's workflows is `references/test-methodology.md`. +A condensed catalog of `WORKFLOW.md` section 4 is in `references/d-guarantees.md`. A condensed guide to `WORKFLOW.md` section 5's audit, trace, and probe procedure is in `references/test-methodology.md`. ## After Any Workflow Edit diff --git a/.agents/skills/workflow-ci-contract/references/d-guarantees.md b/.agents/skills/workflow-ci-contract/references/d-guarantees.md index 880a852e..36003816 100644 --- a/.agents/skills/workflow-ci-contract/references/d-guarantees.md +++ b/.agents/skills/workflow-ci-contract/references/d-guarantees.md @@ -1,6 +1,6 @@ # The D-Guarantees, Condensed -Each guarantee is a MUST from `WORKFLOW.md` section 4, stated as the output a conforming pipeline produces. There an item names an input only where the guarantee applies to a particular trigger or state, and names the failure it prevents only where the output does not already show it. An item naming neither still binds every repo whose shape its domain covers, and a workflow violating any applicable guarantee is not operational. This is the condensed catalog for working from, and `WORKFLOW.md` keeps authority: read the section there when a guarantee's exact wording decides a verdict, since a condensed item can be shorter than the one it condenses. +Each guarantee is a MUST from `WORKFLOW.md` section 4, stated as the output a conforming pipeline produces. In that section an item names an input only where the guarantee applies to a particular trigger or state, and names the failure it prevents only where the output does not already show it. An item naming neither still binds every repo whose shape its domain covers, and a workflow violating any applicable guarantee is not operational. This is the condensed catalog for working from, and `WORKFLOW.md` keeps authority: read the section there when a guarantee's exact wording decides a verdict, since a condensed item can be shorter than the one it condenses. ## D1: PR Fast-Feedback (Smoke) diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest index cbb9674c..80e25e4b 100644 --- a/.claude-plugin/fleet-skills/.source-digest +++ b/.claude-plugin/fleet-skills/.source-digest @@ -1 +1 @@ -53d8187f4029fa5b +52bb883ade7b516e diff --git a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md index 21a144bb..9cf6432d 100644 --- a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md @@ -1,7 +1,7 @@ --- name: workflow-ci-contract description: >- - Governs the WORKFLOW.md CI/CD behavioral contract for every ptr727/ProjectTemplate fleet repo: the D1-D9 guarantees stated as the failure mode each prevents, the seam contract for release assets, the artifact lifecycle, NBGV versioning and classification, validate-at-entry, and the 5A/5B/5C test methodology with its per-type walkthroughs. Use this whenever writing or editing anything under .github/workflows/, adding or dropping a release target, auditing a repo's workflows, or reasoning about why a publish did or did not fire. This is the YAML half of the pipeline, and the operational-vs-release-workflow skill keeps the git half (branching, promotion, publish policy), so branch choice questions go there. Triggers even when the edit looks mechanical, such as bumping an action, renaming a job, or adding one upload step, because SHA pinning, the ruleset-bound aggregator name, smoke gating on uploads, and retention-days are each easy to break in a one-line diff that no smoke build exercises, since workflow-only changes are deliberately not smoke-built. WORKFLOW.md keeps authority, and GOVERNANCE.md wins where the two overlap. + Governs the WORKFLOW.md CI/CD behavioral contract for every ptr727/ProjectTemplate fleet repo: the D1-D9 guarantees, the seam contract for release assets, the artifact lifecycle, NBGV versioning and classification, validate-at-entry, and the 5A/5B/5C test methodology with its per-type walkthroughs. Use this whenever writing or editing anything under .github/workflows/, adding or dropping a release target, auditing a repo's workflows, or reasoning about why a publish did or did not fire. This is the YAML half of the pipeline, and the operational-vs-release-workflow skill keeps the git half (branching, promotion, publish policy), so branch choice questions go there. Triggers even when the edit looks mechanical, such as bumping an action, renaming a job, or adding one upload step, because SHA pinning, the ruleset-bound aggregator name, smoke gating on uploads, and retention-days are each easy to break in a one-line diff that no smoke build exercises, since workflow-only changes are deliberately not smoke-built. WORKFLOW.md keeps authority, and GOVERNANCE.md wins where the two overlap. --- # Workflow CI Contract @@ -40,7 +40,7 @@ description: >- - **No-op republish**: an unchanged version re-pushes nothing, the release-create step skips when the tag exists and is refreshed only on a dispatch, registries dedupe server-side (`--skip-duplicate`, `skip-existing: true`), and Docker alone always re-pushes by design. - **A build failure blocks every publish target**: `github-release` needs every build and guards with `!failure() && !cancelled()` as the terminal registry pusher (Docker) does, and a package target's separate `publish-` job `needs:` the release-task call, so no build failure ships anything partial. A failed package push is outside that, since it runs after the release is cut. -The full catalog, each guarantee with the failure mode it prevents, is in `references/d-guarantees.md`. Auditing, tracing, and probing a repo's workflows is `references/test-methodology.md`. +A condensed catalog of `WORKFLOW.md` section 4 is in `references/d-guarantees.md`. A condensed guide to `WORKFLOW.md` section 5's audit, trace, and probe procedure is in `references/test-methodology.md`. ## After Any Workflow Edit diff --git a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/references/d-guarantees.md b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/references/d-guarantees.md index 880a852e..36003816 100644 --- a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/references/d-guarantees.md +++ b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/references/d-guarantees.md @@ -1,6 +1,6 @@ # The D-Guarantees, Condensed -Each guarantee is a MUST from `WORKFLOW.md` section 4, stated as the output a conforming pipeline produces. There an item names an input only where the guarantee applies to a particular trigger or state, and names the failure it prevents only where the output does not already show it. An item naming neither still binds every repo whose shape its domain covers, and a workflow violating any applicable guarantee is not operational. This is the condensed catalog for working from, and `WORKFLOW.md` keeps authority: read the section there when a guarantee's exact wording decides a verdict, since a condensed item can be shorter than the one it condenses. +Each guarantee is a MUST from `WORKFLOW.md` section 4, stated as the output a conforming pipeline produces. In that section an item names an input only where the guarantee applies to a particular trigger or state, and names the failure it prevents only where the output does not already show it. An item naming neither still binds every repo whose shape its domain covers, and a workflow violating any applicable guarantee is not operational. This is the condensed catalog for working from, and `WORKFLOW.md` keeps authority: read the section there when a guarantee's exact wording decides a verdict, since a condensed item can be shorter than the one it condenses. ## D1: PR Fast-Feedback (Smoke) diff --git a/.github/skills/workflow-ci-contract/SKILL.md b/.github/skills/workflow-ci-contract/SKILL.md index 21a144bb..9cf6432d 100644 --- a/.github/skills/workflow-ci-contract/SKILL.md +++ b/.github/skills/workflow-ci-contract/SKILL.md @@ -1,7 +1,7 @@ --- name: workflow-ci-contract description: >- - Governs the WORKFLOW.md CI/CD behavioral contract for every ptr727/ProjectTemplate fleet repo: the D1-D9 guarantees stated as the failure mode each prevents, the seam contract for release assets, the artifact lifecycle, NBGV versioning and classification, validate-at-entry, and the 5A/5B/5C test methodology with its per-type walkthroughs. Use this whenever writing or editing anything under .github/workflows/, adding or dropping a release target, auditing a repo's workflows, or reasoning about why a publish did or did not fire. This is the YAML half of the pipeline, and the operational-vs-release-workflow skill keeps the git half (branching, promotion, publish policy), so branch choice questions go there. Triggers even when the edit looks mechanical, such as bumping an action, renaming a job, or adding one upload step, because SHA pinning, the ruleset-bound aggregator name, smoke gating on uploads, and retention-days are each easy to break in a one-line diff that no smoke build exercises, since workflow-only changes are deliberately not smoke-built. WORKFLOW.md keeps authority, and GOVERNANCE.md wins where the two overlap. + Governs the WORKFLOW.md CI/CD behavioral contract for every ptr727/ProjectTemplate fleet repo: the D1-D9 guarantees, the seam contract for release assets, the artifact lifecycle, NBGV versioning and classification, validate-at-entry, and the 5A/5B/5C test methodology with its per-type walkthroughs. Use this whenever writing or editing anything under .github/workflows/, adding or dropping a release target, auditing a repo's workflows, or reasoning about why a publish did or did not fire. This is the YAML half of the pipeline, and the operational-vs-release-workflow skill keeps the git half (branching, promotion, publish policy), so branch choice questions go there. Triggers even when the edit looks mechanical, such as bumping an action, renaming a job, or adding one upload step, because SHA pinning, the ruleset-bound aggregator name, smoke gating on uploads, and retention-days are each easy to break in a one-line diff that no smoke build exercises, since workflow-only changes are deliberately not smoke-built. WORKFLOW.md keeps authority, and GOVERNANCE.md wins where the two overlap. --- # Workflow CI Contract @@ -40,7 +40,7 @@ description: >- - **No-op republish**: an unchanged version re-pushes nothing, the release-create step skips when the tag exists and is refreshed only on a dispatch, registries dedupe server-side (`--skip-duplicate`, `skip-existing: true`), and Docker alone always re-pushes by design. - **A build failure blocks every publish target**: `github-release` needs every build and guards with `!failure() && !cancelled()` as the terminal registry pusher (Docker) does, and a package target's separate `publish-` job `needs:` the release-task call, so no build failure ships anything partial. A failed package push is outside that, since it runs after the release is cut. -The full catalog, each guarantee with the failure mode it prevents, is in `references/d-guarantees.md`. Auditing, tracing, and probing a repo's workflows is `references/test-methodology.md`. +A condensed catalog of `WORKFLOW.md` section 4 is in `references/d-guarantees.md`. A condensed guide to `WORKFLOW.md` section 5's audit, trace, and probe procedure is in `references/test-methodology.md`. ## After Any Workflow Edit diff --git a/.github/skills/workflow-ci-contract/references/d-guarantees.md b/.github/skills/workflow-ci-contract/references/d-guarantees.md index 880a852e..36003816 100644 --- a/.github/skills/workflow-ci-contract/references/d-guarantees.md +++ b/.github/skills/workflow-ci-contract/references/d-guarantees.md @@ -1,6 +1,6 @@ # The D-Guarantees, Condensed -Each guarantee is a MUST from `WORKFLOW.md` section 4, stated as the output a conforming pipeline produces. There an item names an input only where the guarantee applies to a particular trigger or state, and names the failure it prevents only where the output does not already show it. An item naming neither still binds every repo whose shape its domain covers, and a workflow violating any applicable guarantee is not operational. This is the condensed catalog for working from, and `WORKFLOW.md` keeps authority: read the section there when a guarantee's exact wording decides a verdict, since a condensed item can be shorter than the one it condenses. +Each guarantee is a MUST from `WORKFLOW.md` section 4, stated as the output a conforming pipeline produces. In that section an item names an input only where the guarantee applies to a particular trigger or state, and names the failure it prevents only where the output does not already show it. An item naming neither still binds every repo whose shape its domain covers, and a workflow violating any applicable guarantee is not operational. This is the condensed catalog for working from, and `WORKFLOW.md` keeps authority: read the section there when a guarantee's exact wording decides a verdict, since a condensed item can be shorter than the one it condenses. ## D1: PR Fast-Feedback (Smoke) diff --git a/WORKFLOW.md b/WORKFLOW.md index aa988eb2..3337b61e 100644 --- a/WORKFLOW.md +++ b/WORKFLOW.md @@ -12,7 +12,7 @@ Given this document, an agent must be able to do three things to any project: > **Canonical scope.** This document is authoritative for the workflow contract and test methodology (sections 3 to 6). The conventions in section 2 and the release policy also live in `GOVERNANCE.md` ("Workflow YAML Conventions" and "Release Model"), which is authoritative where the two overlap. Section 2 restates them so this file reads on its own. On any conflict in that overlap, `GOVERNANCE.md` wins. -The guarantees are distilled from failures observed in practice and stated as the **failure-mode each prevents**, so the document stays portable to any project. +The guarantees are distilled from failures observed in practice. Section 4's preamble states how each item is written. ## 1. Purpose and How to Use This Document diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md index c7720113..7b50061b 100644 --- a/docs/reusable-workflows.md +++ b/docs/reusable-workflows.md @@ -312,6 +312,7 @@ jobs: - 'Widget/**' - 'Directory.Build.props' - 'Directory.Packages.props' + - 'global.json' - 'version.json' - '.github/actions/**' @@ -432,6 +433,7 @@ on: - 'version.json' - 'Directory.Build.props' - 'Directory.Packages.props' + - 'global.json' workflow_dispatch: concurrency: diff --git a/reports/canonical-review.json b/reports/canonical-review.json index 00a37f18..b5a6181f 100644 --- a/reports/canonical-review.json +++ b/reports/canonical-review.json @@ -233,6 +233,14 @@ "hubCommit": "a76dda7d67033f43c260d21e3ae6a291e1869c0a", "stamp": "2026-09-01T06:46:39Z" }, + { + "unit": ".agents/skills/workflow-ci-contract/SKILL.md > (preamble)", + "digest": "sha256:b7bf2ed878797d025cd67ba7191b40c1988a1cf0233e0141e73dfe347f1a0836", + "reviewer": "agent-skill", + "findings": 4, + "hubCommit": "99f8de2209405d2dfa8b6d648dc42d55ee3de060", + "stamp": "2026-09-02T19:10:19Z" + }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > After Any Workflow Edit", "digest": "sha256:7dc31b8f1e7e25effd4b85078f9099b89cf3663452ed0400cf255df019fbef0e", @@ -259,19 +267,19 @@ }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > The Core Behavioral Spine", - "digest": "sha256:0061a17edeb3c838b1a72e17dfac823e03a22156a450cf06816f70706c42ffe3", + "digest": "sha256:0b53bafe901f2482156fffb07b24cb26968f5cae3c6da1e71bc713c24ab5cfd5", "reviewer": "agent-skill", - "findings": 9, - "hubCommit": "5085d22962752a8690b5bc21095fe7bc91c25f28", - "stamp": "2026-09-02T16:34:43Z" + "findings": 5, + "hubCommit": "1de415fbc5de255f04b2b7f71d42f1f240355639", + "stamp": "2026-09-02T19:38:44Z" }, { "unit": ".agents/skills/workflow-ci-contract/references/d-guarantees.md > (preamble)", - "digest": "sha256:2c0dee23dd279030b8e79e015ca5238eb9031999946dcd844b643fcd2baac723", + "digest": "sha256:f5ff09431c97a4c1c86d29b387a686805c467e7761d54e37ca61e75d4d0b2173", "reviewer": "agent-skill", - "findings": 62, - "hubCommit": "9b33edb7e0f55fe2a05630a49d5be99ba1e3eb26", - "stamp": "2026-09-02T15:16:10Z" + "findings": 5, + "hubCommit": "99f8de2209405d2dfa8b6d648dc42d55ee3de060", + "stamp": "2026-09-02T18:38:20Z" }, { "unit": ".agents/skills/workflow-ci-contract/references/d-guarantees.md > D1: PR Fast-Feedback (Smoke)", @@ -409,6 +417,14 @@ "hubCommit": "30c465ae79de328d2745c31df1b05f0d960c42b7", "stamp": "2026-09-02T15:40:54Z" }, + { + "unit": "WORKFLOW.md > (preamble)", + "digest": "sha256:ea8cdbdf569d5476aa300eee0f797f0318b1a488ea690955f1cc2244b620d3b3", + "reviewer": "agent-skill", + "findings": 8, + "hubCommit": "99f8de2209405d2dfa8b6d648dc42d55ee3de060", + "stamp": "2026-09-02T19:16:34Z" + }, { "unit": "WORKFLOW.md > 1. Purpose and How to Use This Document", "digest": "sha256:35a8c77043da983af04a46300f652d4e3b8a454815b10c380524832cfdbe4a70", diff --git a/reports/canonical-review.md b/reports/canonical-review.md index 589502b7..153fa9eb 100644 --- a/reports/canonical-review.md +++ b/reports/canonical-review.md @@ -7,9 +7,9 @@ A unit is what a reviewer reads whole, decided by the carry manifest rather than ## Coverage - units: 288 -- covered: 57 +- covered: 59 - stale: 0 -- never read here: 231 +- never read here: 229 ## Burn-down @@ -296,7 +296,6 @@ A unit is what a reviewer reads whole, decided by the carry manifest rather than ### .agents/skills/workflow-ci-contract/SKILL.md -- **(preamble)** - never - **Why This Exists** - never ### .agents/skills/workflow-ci-contract/references/d-guarantees.md @@ -382,10 +381,6 @@ A unit is what a reviewer reads whole, decided by the carry manifest rather than - **Representative Data in Agent-Authored Text** - never - **Supported Development Platforms** - never -### WORKFLOW.md - -- **(preamble)** - never - ### cspell.json - **(whole file)** - never