fix(skills): encode carry-forward review, signing, matrix, and merge rules

ROADMAP.md

@@ -53,19 +53,19 @@ Open items registered by retro docs (`docs/retros/`), pushed here per `retrospec
 | ~~`execution: ops` as a possible third execution mode~~ **Done** carry-forward-clear batch | 2026-07-27 plan-status-terminal-states cycle | P3 | ~~First `execution: ops` instance in this repo~~ resolved: added `ops` to `plan-schema.md` enum and `validate-plan-frontmatter.py` EXECUTIONS set |
 | ~~Procedural skill text can authorize durable state transitions even when the tracked diff is documentation-only~~ **Done** default-worktree-isolation cycle | 2026-08-03 archive-on-loop-completion retro | P2 | ~~Next planning cycle whose procedural workflow text authorizes durable local mutation~~ resolved: the plan classified runtime effects and included a mutation/failure-state matrix, with Deviation 006 retaining the observed partial branch state |
 | A success criterion that fires after Retro cannot be measured inside that Retro's Phase 3 pass | 2026-08-03 archive-on-loop-completion retro | P3 | Next design or retrospective cycle declaring a post-Retro terminal criterion — assign proof to the release-loop completion gate and retain the exact evidence path |
-| Forced-failure matrices can omit the exact partial durable state and persist invalid shell syntax in Markdown tables | 2026-08-05 default-worktree-isolation retro | P3 | **Fired** in PR #15: plan-specific T0-T7 carried executable probes, expected partial states, rerun behavior, and compensation owners; durable rule remains — next planning-contract change must add the reusable requirement to the matrix contract |
-| Facilitator and reviewer output is never persisted, so review claims rest on ledger summaries rather than the reviewer's own words | 2026-08-15 retro-interview-integrity retro | P3 | Next change to the interview protocol's round contract or to `reviewing`'s dispatch steps — write reviewer output verbatim to an artifact at dispatch time |
-| Review verifies conformance to the sealed plan instead of attacking the invariant the plan claims to establish | 2026-08-14 retro-interview-integrity retro (T6) | P1 | **Fired** in PR #15: Design, plan, and implementation reviews attacked the claimed invariants; durable rule remains — next change to `reviewing`'s dispatch contract must require construction of the cheapest conforming counterexample |
-| Finding severity graded against the blast radius of the code rather than the success criterion the finding threatens | 2026-08-14 retro-interview-integrity retro (T7) | P2 | **Fired** in PR #15: every bounded review graded against the threatened success criterion; durable rule remains — next change to the review triage contract must encode this rule |
-| Dispatched agents that commit do not inherit `SSH_AUTH_SOCK`, so their commits land unsigned on an otherwise signed branch | 2026-08-14 retro-interview-integrity retro | P3 | **Fired** in PR #15: U1-U4 were committed by dispatched implementers and all four reported `%G? = G`, but socket pass-through was not retained as evidence; durable rule remains — next dispatched-committer cycle must pass the socket explicitly and verify `%G?` per commit |
+| ~~Forced-failure matrices can omit the exact partial durable state and persist invalid shell syntax in Markdown tables~~ **Done** carry-forward bundle A | 2026-08-05 default-worktree-isolation retro | P3 | ~~Next planning-contract change must add the reusable requirement to the matrix contract~~ resolved: partial-state half landed in #22 (`exact partial durable state`); `skills/planning/SKILL.md` matrix contract and self-review plus `plan-schema.md` now require matrix-cell commands to escape literal `\|` or use a referenced fenced block and pass `bash -n` |
+| Facilitator and reviewer output is never persisted, so review claims rest on ledger summaries rather than the reviewer's own words | 2026-08-15 retro-interview-integrity retro | P3 | Next change to the interview protocol's round contract or to `reviewing`'s dispatch steps — write reviewer output verbatim to an artifact at dispatch time. **Fired** by carry-forward bundle A (implementing task-review prompt edit); deferred: the reviewer half is implemented on unmerged `orca/reproducible-evidence` (`review-event-integrity.py complete`) and lands with that branch; the facilitator half stays open |
+| ~~Review verifies conformance to the sealed plan instead of attacking the invariant the plan claims to establish~~ **Done** | 2026-08-14 retro-interview-integrity retro (T6) | P1 | ~~Next change to `reviewing`'s dispatch contract must require construction of the cheapest conforming counterexample~~ resolved: PR #22 (295909c) added the invariant-attack instruction to `skills/reviewing/SKILL.md` Step 4 and the implementing unit/final review prompts, asserted by `require_review_contract` |
+| ~~Finding severity graded against the blast radius of the code rather than the success criterion the finding threatens~~ **Done** carry-forward bundle A | 2026-08-14 retro-interview-integrity retro (T7) | P2 | ~~Next change to the review triage contract must encode this rule~~ resolved: `skills/reviewing/SKILL.md` Step 5, the lane pre-delivery gate, and the implementing task-review prompt grade by threatened criterion; an integrity-mechanism hole is never below P1 |
+| ~~Dispatched agents that commit do not inherit `SSH_AUTH_SOCK`, so their commits land unsigned on an otherwise signed branch~~ **Done** carry-forward bundle A | 2026-08-14 retro-interview-integrity retro | P3 | ~~Next dispatched-committer cycle must pass the socket explicitly and verify `%G?` per commit~~ resolved: `skills/implementing/SKILL.md` step 2 signing pass-through passes `SSH_AUTH_SOCK` by reference to every committing worker, including fix subagents, and blocks a unit whose commits are not `G`/`U` or carry a `%GK` key other than the orchestrator's own |
 | A retro committed on a feature branch must be merged or pushed in the same action, with the ledger pointer updated then | 2026-08-15 retro-interview-integrity retro | P2 | **Fired** in the run-artifact-integrity recovery — push or merge `retro/run-artifact-integrity` and update the ledger pointer before archive cleanup |
-| `gh pr merge --delete-branch` can merge remotely and then exit 1 when local branch cleanup collides with a base branch checked out in another worktree | 2026-08-16 planning-discrimination-and-verdict-coverage retro (T5) | P2 | **Fired again** in PRs #22 and #23 — next shipping merge-command change must split remote merge, merged-result verification, state handoff, local worktree cleanup, local branch deletion, and remote branch deletion |
+| ~~`gh pr merge --delete-branch` can merge remotely and then exit 1 when local branch cleanup collides with a base branch checked out in another worktree~~ **Done** carry-forward bundle A | 2026-08-16 planning-discrimination-and-verdict-coverage retro (T5) | P2 | ~~Next shipping merge-command change must split the operations~~ resolved: `skills/shipping/SKILL.md` merges with `gh pr merge <number> --squash [--auto]`, checks `MERGED` before any retry, and deletes the local then remote branch as separate compare-and-delete steps bound to the merged PR's `headRefOid` (`git update-ref -d`, `git push --force-with-lease`; same-repository heads only); conformance fixtures follow the new argv |
 | Canonical adoption evidence publication rewrites repository records with run-specific timestamps and temporary paths, and per-record replacement can expose mixed generations | 2026-08-16 schema-reference-and-seal-verification retro (T12) | P1 | Next change to `scripts/test-body-seal.sh` evidence publication — keep default validation fixture-local or publish a complete hash-manifested generation through one atomic pointer; consumers fail closed on record/manifest mismatch |
-| A final approval can coexist with an unresolved outside-diff finding because thread counts exclude review-body findings | 2026-08-16 schema-reference-and-seal-verification retro (T12, T16) | P1 | **Partially fired again** in PR #22: reviewing now inventories review-body and outside-diff fingerprints with dispositions. Remainder: Shipping still lacks the same per-fingerprint terminal-disposition gate — re-armed for the next shipping or release-loop merge-gate change |
+| A final approval can coexist with an unresolved outside-diff finding because thread counts exclude review-body findings | 2026-08-16 schema-reference-and-seal-verification retro (T12, T16) | P1 | **Partially fired again** in PR #22: reviewing now inventories review-body and outside-diff fingerprints with dispositions. Remainder: Shipping still lacks the same per-fingerprint terminal-disposition gate. **Fired** again by carry-forward bundle A (Step 7 merge-command change); deferred: unmerged `orca/reproducible-evidence` implements the gate as `review-event-integrity.py verify-gate` in Shipping Step 7 and lands with that branch |
 | ~~Legacy selected ledgers have no collision-safe handoff destination contract, so cleanup cannot preserve evidence for mandatory Retro~~ **Done** | 2026-08-25 run-artifact-integrity retro (T4) | P1 | ~~Next change to handoff or Ship cleanup~~ resolved: PR #26 (648f1883) implements crash-recoverable legacy handoff with closed allowlist, v2 marker, collision detection, symlink rejection, `--legacy-destination` opt-in, and acceptance matrix in `transition-hooks.md` and `shipping/SKILL.md` |
 | Post-merge fix claims retain summarized results but not publisher-owned raw failure and RED/GREEN traces | 2026-08-25 run-artifact-integrity retro (T3) | P2 | Next merged-result failure that creates a follow-up — publish bounded raw output and exact environment observations before citing root cause |
-| Two spec-declared test case names (`legacy_handoff_source_changed`, `legacy_handoff_complete_rerun`) were never implemented; add them to close the SC3/SC4 measurement gap | 2026-08-25 legacy-handoff-contract retro (T2) | P2 | Next change to legacy handoff test cases or spec measurement contract |
-| Add a mid-directory-copy fault injection (`handoff-after-copy-one-file`) to exercise partial-directory recovery directly | 2026-08-25 legacy-handoff-contract retro (T3) | P3 | Next change to handoff fault injection or recovery code |
+| ~~Two spec-declared test case names (`legacy_handoff_source_changed`, `legacy_handoff_complete_rerun`) were never implemented; add them to close the SC3/SC4 measurement gap~~ **Done** | 2026-08-25 legacy-handoff-contract retro (T2) | P2 | ~~Next change to legacy handoff test cases or spec measurement contract~~ resolved: PR #32 (22fcd46) registered both cases in `scripts/test-run-artifact-integrity.sh` |
+| ~~Add a mid-directory-copy fault injection (`handoff-after-copy-one-file`) to exercise partial-directory recovery directly~~ **Done** | 2026-08-25 legacy-handoff-contract retro (T3) | P3 | ~~Next change to handoff fault injection or recovery code~~ resolved: PR #32 (22fcd46) added the injection to `run-artifact-integrity.py`, used by `legacy_handoff_v1_partial_directory_rerun` and `legacy_handoff_source_changed` |
 | ~~Structured review events must be populated when `completeness: exact` — either use the event system or downgrade to `partial`~~ **Done** | 2026-08-25 legacy-handoff-contract retro; resolved 2026-09-20 auto-plan-assumption-tradeoffs retro (T1) | P3 | Resolved: events 1–3 use publisher-owned wrappers, and the ledger explicitly retains `completeness: partial` rather than claiming exact historical coverage |
 | Review re-review verification must be executable rather than manual ledger editing | 2026-09-19 auto-plan-assumption-tradeoffs retro (T2) | P2 | Next change to reviewing or implementing review-event operations — expose a packaged `verify_re_review` path that validates source/result inventories and writes fixed dispositions atomically |
 

docs/solutions/workflow-issues/squash-merge-commit-message-not-rewritten.md

@@ -43,7 +43,8 @@ Net reduction: 165,383 → 149,832 B (−9.4%). All gate/integrity
 clauses preserved; validate.sh + portability suite green.
 EOF
 
-gh pr merge <number> --squash --delete-branch --body-file "$BODY_FILE"
+# Branch deletion is a separate step (shipping Step 8); never add --delete-branch.
+gh pr merge <number> --squash --body-file "$BODY_FILE"
 ```
 
 Key points:

scripts/test-plan-consumer-portability.sh

@@ -2655,11 +2655,16 @@ for fragment in (
     "<artifact_root>/briefs/U<N>-brief.md",
     "<artifact_root>/reports/U<N>-report.md",
     "<artifact_root>/reviews/U<N>-diff.txt",
+    "SSH_AUTH_SOCK",
+    "--format='%h %G? %GK'",
+    "including step 9 fix subagents",
+    "blocks the unit until that commit is re-signed",
+    "the orchestrator's own signing key",
 ):
     assert fragment in implementing, fragment
 
 schema = (plugin_root / "skills/planning/schemas/plan-schema.md").read_text(encoding="utf-8")
-for fragment in ("<artifact_root>/evidence/U<N>/", "executable probe", "exact partial durable state", "compensation owner"):
+for fragment in ("<artifact_root>/evidence/U<N>/", "executable probe", "exact partial durable state", "compensation owner", "escapes every literal `|` as `\\|`"):
     assert fragment in schema, fragment
 
 plan_filename_stem = "2026-08-23-001-fix-portable-plan"

scripts/test-release-loop-conformance.sh

@@ -532,8 +532,8 @@ def validate_gh_command(argv, fixture_root):
     if len(argv) == 6 and argv[1:4] == ["pr", "comment", "1"] and argv[4] == "--body" and argv[5]:
         return True, "fixture-gh-comment"
     if argv in (
-        ["gh", "pr", "merge", "1", "--squash", "--delete-branch"],
-        ["gh", "pr", "merge", "1", "--squash", "--delete-branch", "--auto"],
+        ["gh", "pr", "merge", "1", "--squash"],
+        ["gh", "pr", "merge", "1", "--squash", "--auto"],
     ):
         return True, "fixture-gh-merge"
     if argv in (
@@ -753,8 +753,8 @@ def gh_allowed():
     if len(args) == 6 and args[1:4] == ["pr", "comment", "1"] and args[4] == "--body" and args[5]:
         return True
     if args in (
-        ["gh", "pr", "merge", "1", "--squash", "--delete-branch"],
-        ["gh", "pr", "merge", "1", "--squash", "--delete-branch", "--auto"],
+        ["gh", "pr", "merge", "1", "--squash"],
+        ["gh", "pr", "merge", "1", "--squash", "--auto"],
     ):
         return True
     if args in (
@@ -860,8 +860,6 @@ elif args[:2] == ["pr", "merge"]:
     git("merge", "--squash", "origin/feat/fuzz-fixture", cwd=merge_repo)
     git("commit", "-m", "fixture squash merge", cwd=merge_repo)
     git("push", "origin", "main", cwd=merge_repo)
-    if "--delete-branch" in args:
-        git("push", "origin", "--delete", "feat/fuzz-fixture", cwd=merge_repo)
     pr["merged"] = True
     pr["merge_sha"] = git("rev-parse", "HEAD", cwd=merge_repo)
     save()
@@ -1251,7 +1249,7 @@ def validate_fixture():
             ["gh", "api", "repos/{owner}/{repo}/pulls/1/reviews", "--jq", "length"],
             ["gh", "api", "repos/{owner}/{repo}/pulls/1/comments", "--jq", "length"],
             ["gh", "api", "graphql", "-F", "number=1", "-f", "query=fixture"],
-            ["gh", "pr", "merge", "1", "--squash", "--delete-branch"],
+            ["gh", "pr", "merge", "1", "--squash"],
             ["gh", "pr", "view", "1", "--json", "mergeCommit", "--jq", ".mergeCommit.oid // empty"],
         )
         results = [
@@ -1288,7 +1286,7 @@ def validate_fixture():
             wrapper_command + ["git", "push", "origin", "--receive-pack=false", "main"],
             wrapper_command + ["gh", "release", "create", "v1"],
             wrapper_command + ["gh", "pr", "view", "1", "--repo", "outside/repo"],
-            wrapper_command + ["gh", "pr", "merge", "1", "--squash", "--delete-branch", "--repo", "outside/repo"],
+            wrapper_command + ["gh", "pr", "merge", "1", "--squash", "--repo", "outside/repo"],
             wrapper_command + ["gh", "api", "--hostname", "example.invalid", "user"],
         )
         for command in forbidden: