| name | github-delivery |
| description | Git/GitHub delivery: commits, version/changelog prep, PRDs, triage/QA, research, PRs, trackers, stacks, backports, reviews, conflicts, watch/status, merge/closure. Watch MUST run scripts/ship-gate.mjs every wake. Default mode is read-only. Not for general local debugging, non-GitHub planning, or skill authoring.
|
GitHub Delivery
Own GitHub work from product intake through release-ready change. Natural language is the public API. Bounded progress; evidence/context economy.
Route
Match the request, then load only the selected workflow plus the policy
modules declared at the top of that workflow. Do not load
references/shared-rules.md as mandatory context; it is now a compatibility
index.
Full-review routing is explicit: when the user asks for a full review, route
to references/full-review-pr.md; bot-fix, CodeRabbit, Codex, security, or
simplify clauses in the same request do not steal that route. When the same
request also explicitly asks to merge, route to
references/prepare-and-merge-pr.md, complete the requested full-review/fix/
simplify preparation first, then enter the merge workflow.
| Request shape | Workflow |
|---|
| Create a PRD from conversation, repository context, or an idea | references/issue-workflows.md → PRD Workflow |
| Break a PRD, plan, spec, or issue into implementation issues | references/issue-workflows.md → Issue Breakdown |
| Create GitHub issue(s) from a clear request or verified finding | references/issue-workflows.md → Issue Breakdown (create_issue) |
| Triage issue(s), labels, state, readiness, or rejection | references/issue-workflows.md → Triage Workflow |
| Run QA intake or file reproducible conversational bug reports | references/issue-workflows.md → QA Intake |
| Create a refactor request, RFC, or verified tiny-commit plan | references/issue-workflows.md → Refactor Plan |
Write or update a ready-for-agent issue contract | references/agent-brief.md |
| Record, match, reconsider, or remove a rejected enhancement decision | references/out-of-scope.md |
| Branch/commit work or Git history | references/git-workflow.md |
| SemVer, changelog, release/tag prep | references/versioning-release.md |
| Fix humans/bots on PR #N; own bug+security+spec; merge-ready | references/fix-pr-bots.md |
| Watch / monitor PR #N (CI + new reviews until merged/closed/blocker) | references/watch-pr.md |
| Re-review PR #N from human review + commits + new rabbit/Codex | references/re-review-pr.md |
| Research issue(s) #N on latest development; priority; comment on issue | references/research-issue.md |
| Create a PR from already-existing local work, with no issue supplied | references/create-pr-from-local-work.md |
| Create PR for issue #N (bounded preflight → implement → pre-open bug/security gate); link + merge-ready | references/create-pr-for-issue.md |
| List my open PRs / what’s in review / repository open-work standup (read-only overview) | references/open-work-status.md |
| Inspect or deliver external work item ENG-42 through the GitHub lifecycle | references/work-item-delivery.md |
| Find competing / overlapping PR implementations (analysis only) | references/consolidate-prs.md |
| Backport / port PR #N to one or more target base branches | references/multi-base-delivery.md |
| Full review on PR #N (or a list); babysit to green + verdict | references/full-review-pr.md |
| Spec and Standards review on PR #N | references/spec-standards-review.md |
| Simplify / no-comments PR #N | references/simplify-pr.md references/no-comments.md |
| Security review on PR #N | references/security-review.md |
| Status / what’s left / is PR #N merge ready? (read-only; same bar) | references/status.md |
| Merge PR #N; why-good + thanks; issue thank + close | references/merge-pr.md |
| Supersede / replace PR #N with replacement PR #M | references/supersede-pr.md |
| Maintainer overtake / take over PR #N | references/overtake-pr.md |
| Active Git conflict while updating or shipping a PR | references/resolve-conflicts.md, then resume |
| Inspect / restack / retarget / recover / merge existing stacked PRs | references/stacked-prs.md |
| Split oversized change into reviewable PRs | Hand off to skill split-to-prs |
| Finish branch / worktree cleanup after ship | Hand off to skill finishing-a-development-branch |
If a request spans multiple rows, run them in lifecycle order and load only the
current workflow bundle. Within references/issue-workflows.md, read only the
selected workflow section plus companions it explicitly names.
For full review + simplify, references/full-review-pr.md remains
authoritative and composes simplification before the final verdict. For a
compound review/fix/simplify plus merge request, use
references/prepare-and-merge-pr.md: complete requested preparation first,
revalidate, then enter the merge workflow. For research issue + create PR,
complete research once; when the verdict still needs a fix, hand the captured
development-tip / issue-state evidence directly into references/create-pr-for-issue.md
and begin implementation. Do not repeat unchanged research. The create-PR
pre-open bug/security gate is post-implementation and pre-publication.
Triage may compose agent-brief; confirmed rejection may compose out-of-scope.
Hygiene passes default on unless the request opts out; line count is never a goal.
If a PR is stacked, load the stacks conditional module and
references/stacked-prs.md before mutation/readiness/merge decisions. Stack
policy remains authoritative for topology; the selected workflow owns the
individual PR's review/fix/readiness bar.
Policy loading contract
Load references/policy-kernel.md, the selected workflow's unconditional
modules, and conditionals only when their observable condition is true.
node scripts/policy-bundle.mjs <workflow> resolves/validates this bundle.
Workflows cannot weaken GD-* rules. GD-CORE-001 through GD-CORE-010 remain mandatory.
Workflow controller contract
After routing, run node scripts/workflow-brief.mjs <workflow> once and use one
persistent delivery-controller.mjs checkpoint. Route/phase graph stay locked;
the controller owns transitions, evidence/retry/resource/no-progress accounting
and resume. Only phase/state/blocker/required-evidence/execution change is
progress. Conditional policy extends unchanged context. The controller grants
no GitHub write authority. Run routine deterministic tooling quietly; narrate only material progress or blockers (GD-CORE-009).
Mandatory entrypoint behavior
- Default mutation mode is read-only. Available profiles are
read-only,
review, maintainer, and autonomous; the profile is an upper bound.
Human replies always require exact-text confirmation. Public GitHub text
must keep notifying mentions bare: never wrap GitHub @login mentions in backticks.
Detailed rules: references/policy/mutation.md and references/mutation-modes.md.
- Issue-linked create-PR forward progress is explicit: bounded need-to-fix research decides
whether work is needed, then implementation begins.
pre-open-gate.mjs reviews
the resulting non-empty candidate diff before publication; it must never be
treated as a prerequisite for writing the first implementation commit. Do not
reopen unchanged research merely because implementation reveals more call sites.
- Authoritative gate:
scripts/ship-gate.mjs. Watch MUST run
scripts/ship-gate.mjs every wake. Before merge-ready or merge, the final ship-gate.mjs result must be ready on unchanged heads.
Component helpers diagnose; they never overrule that decision.
- Red required checks use the
baseHealth component: fix_in_pr,
separate_follow_up, or investigate; unknown origin is a hard evidence stop.
See references/policy/ci.md and references/base-health.md.
- Bot threads on paths in this PR diff must be fixed here or explicitly
declined with verified rationale; never defer with
[GD] + resolve to another PR/rebase.
Never resolve a bot thread with only a defer/skip reply. See
references/policy/reviews.md.
- Merge-ready paths run their required Bug + Security + Spec + Standards review
and proactive contract verification; passing bots/checks alone is not
sufficient. See
references/policy/reviews.md and focused review methods.
- Non-merge writes use
github-mutate.mjs; merges use only merge-pr-driver.mjs.
Generic merge_pr mutation documents are rejected. Do not invoke
github-authorize.mjs separately in routine workflows. See
references/policy/mutation.md and references/merge-pr.md.
- Never use bare force, never silently discard unrelated work, and honor the PR
ownership/fork-write boundary. See .
Full-review contracts that remain entrypoint-visible
A full review is not complete merely because analysis stopped. Full-review completion lock: the plan item Publish final verdict remains pending or
in_progress until the required verdict is actually published and verified. A
blocker changes the verdict; it does not remove the verdict requirement. Only explicit user cancellation permits ending the required publication workflow
without it. Verify normal publication using scripts/verify-verdict-published.mjs.
A self-selected stricter mutation mode is not publication unavailability.
Each full-review run has a full-review-run-id. Apply the same-head anti-noise
rule: compare the strict label/TLDR material delta and do not post a second top-level verdict when there is no material change. planVerdictPublication
remains the machine decision.
Full review also performs a Semantic propagation audit: Search the repository beyond the changed files, trace canonical/derived representations and material
variant families, prove parity or test every relevant partition, including
expected absences and rejected values. One representative member is insufficient unless equivalence is proved. Method:
references/semantic-propagation-review.md.
Safety precedence
Kernel/modules and executable gates override workflow prose; workflows cannot
waive canonical rules. If runtime instructions genuinely conflict and the
stricter safe behavior is unclear, fail closed and surface the contradiction.
