bridge-sync

name	bridge-sync
description	End-of-sprint batch-sync: pushes ALL pending scope:core + scope:org commits from the local user branch to BOTH upstreams (open-bridge + your org overlay) in one operation, with per-destination scrubbing and parallel PR creation. Complements /promote (per-commit) and /contribute (per-file) with a sprint-level workflow. Trigger: "/bridge-sync", "sync to upstreams", "push to both", "batch promote", "end-of-sprint sync", "sync all pending", "push everything to both repos".
metadata	{"scope":"core"}

Bridge Sync — Batch end-of-sprint upstream sync

/bridge-sync is the wide-net complement to /promote and /contribute.

Skill	Granularity	Use case
/promote	per-commit	"promote this batch of recent commits"
/contribute	per-file	"scan for upstream-worthy files, adapt, PR"
/bridge-sync	per-sprint	"push EVERYTHING pending to both upstreams now"

Read the referenced file ONLY when triggered.

When to use

• End of a work-sprint, ready to publish all upstream-worthy changes at once
• After a refactor that touched many CORE+org files — manual cherry-pick is tedious
• When /promote has been deferred for days and there's a backlog
• When you want both bks-lab/open-bridge and your org overlay updated in one operation

NOT for:

• A single commit (/promote is leaner)
• File-level adaptation work (/contribute --adapt does that)
• USER-only changes (those stay local)

Arguments

Argument	Effect	Default
(none)	Full sync to both upstreams	—
--dry-run	Show routing matrix, don't push	false
--repo open-bridge	Sync only to open-bridge	both
--repo <your-bridge>	Sync only to your org overlay	both
--since <ref>	Sync commits since this ref (default: last sync tag)	last sync
--no-scrub	Disable open-bridge scrubbing (DANGER — only for emergency)	false

Prerequisites

• Current branch must be user/*. Refuses on development / main.
• bridge-config.yaml.upstreams[] defines BOTH upstreams.
• git remote has origin (your fork) + upstream (typically <your-org>/<your-bridge>).
• For open-bridge sync: gh CLI authenticated with cross-fork PR rights.

Decision Tree

User wants to...
├── Full sync (default)                  → references/workflow.md
├── Dry-run / preview routing            → references/workflow.md (stop after Step 4)
├── Sync only one repo                   → references/workflow.md § --repo override
├── Configure scrub patterns             → rules/promote-safety.md per-repo blocklists
├── Tag the sync point                   → references/workflow.md § sync-tag
└── PR merge fails after squash-merge    → references/pr-recovery-patterns.md
    (stale-ancestor / non-fast-forward)

Safety

/bridge-sync runs a three-layer safety pipeline per destination (see rules/promote-safety.md for the full rule):

1. scrub_rules.<dest> — auto-rewrite during cherry-pick. Maps personal/internal tokens (your username, org, hostnames) to placeholders. Configured in bridge-config.yaml.promote.scrub_rules.
2. content_blocklist.<dest> — hard-block scan after scrub. Hits classify as scrubable (handled by layer 1), adaptable (defer for /contribute --adapt), or personal-PII (refuse).
3. Universal patterns — private keys, API tokens, paths — always blocked regardless of destination.

A commit hitting an adaptable pattern doesn't block the whole sync — it gets routed as 🟡 in the matrix and deferred. The clean commits still ship. --no-scrub only disables layer 1 (auto-rewrite); layers 2+3 always run.

Workflow recipes for conflict resolution (DU / UU / divergent structure), MIXED-CU cherry-picks, and residual-leak fixup (git commit --fixup + rebase --autosquash) live in references/workflow.md § Step 5.