Epic: Fully-automated fleet-wide version+channel shim compliance (no manual deploy / admin-merge)

Goal

Every repo carries every required caller-stub shim, pinned to its agent's moving major-scoped channel @<agent>/v<M>-stable, so a new reusable version reaches the whole fleet by a canary tag move — never a redeploy. Placement and drift-correction are fully automated by the existing systems; no manual deploy-standard-workflows.sh runs and no admin-merge.

Principle

The 2026-07-21 rollout (#844/#847) was hand-driven (manual sweeps, --admin, quarantine). That fought the systems. The version+channel model + canary rollout + compliance audit already exist; the gaps are two missing automation pieces (a deployer and an auto-merge path). Improve the systems; do not supersede them.

Dependency DAG

graph LR
  B["#852 · B: standards-sync auto-merge<br/>(bootstrap: 1× admin-merge)"]
  I["#849 · templates → v&lt;M&gt;-stable + audit pin-check"]
  A["#851 · A: automated deploy driver"]
  D["#856 · D: SKIP_REPOS opt-in + repo-template exemption"]
  E["#857 · E: fleet convergence (via automation)"]
  B --> I
  B --> A
  B --> D
  I --> A
  I --> D
  A --> E
  D --> E
  B --> E

Sequencing (phased — minimizes bootstrap to a single admin-merge)

Phase	Story	Depends on	Merges via	Acceptance (one-line)
0 — bootstrap	#852 (B) auto-merge	—	admin-merge (the one unavoidable bootstrap)	A `standards-sync` PR with green required checks merges through branch protection, no `--admin`
1 — foundation	#849 templates + audit pin	#852 (to auto-merge)	auto-merge (#852)	All 13 stale templates pin their agent's current `@<agent>/v<M>-stable`; audit flags any bare-tag/off-channel pin
2 — automation (parallel)	#851 (A) deploy driver	#849, #852	auto-merge (#852)	Scheduled+dispatch workflow sweeps drift → standards-sync PRs; compliant repos untouched
	#856 (D) exemptions	#849, #852	auto-merge (#852)	repo-template no longer flagged for placeholder; SKIP_REPOS opt-in codified + tested
3 — converge	#857 (E) fleet convergence	#849, #851, #852, #856	driven by #851 + #852	Audit reports 0 missing + 0 wrong-channel findings fleet-wide; ContentTwin bats passes against the deployed stub; no manual runs

Bootstrap note (approved): only #852 needs an admin-merge (you can't auto-merge the fix that creates auto-merge). Once #852 lands, #849/#851/#856 auto-merge through the system, and #857 runs entirely on the automation.

Epic-level acceptance (rollup)

A reusable version cut reaches the fleet by a canary tag move alone (no shim redeploy) — spot-checked.
The scheduled deploy driver + auto-merge converge any drift with zero manual intervention (no --admin, no quarantine) after the [#850 B] Auto-merge standards-sync PRs through branch protection (resolve the reviewer deadlock — no --admin) #852 bootstrap.
Compliance audit: every repo present + correctly channel-pinned; ContentTwin's add-to-project-workflow.bats green against the deployed stub.
Templates, audit, deploy, and canary agree on the version+channel model end-to-end.

Stories

Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849 — templates → major-scoped channel pins + audit pin-check (foundation; also story C)
[#850 A] Automated standards-deploy driver (scheduled fleet sweep → standards-sync PRs) #851 — A: automated standards-deploy driver
[#850 B] Auto-merge standards-sync PRs through branch protection (resolve the reviewer deadlock — no --admin) #852 — B: standards-sync auto-merge (resolve reviewer deadlock)
[#850 D] Codify SKIP_REPOS opt-in + exempt repo-template from feature-ideation placeholder check #856 — D: SKIP_REPOS opt-in + repo-template placeholder exemption
[#850 E] Fleet convergence: sweep all repos to correct v<M>-stable channel pins via the automation (no manual runs) #857 — E: fleet convergence via the automation

Refs

#657 (major-scoped channels), #849 (templates), #847/#848 (SKIP_REPOS reconcile), #844 (required-everywhere).

Stories filed: #849 (templates), #851 (deploy driver, story A), #852 (auto-merge, story B). Story C folds into #849 (audit pin-check); D (exemptions) extends #847 + repo-template placeholder; E (fleet convergence) is the gated run once A–D + #849 land — driven by the deploy driver + auto-merge, verified by the audit, no manual sweeps.

Dev-Lead Implementation Plan

Issue: #850 — Epic: Fully-automated fleet-wide version+channel shim compliance (no manual deploy / admin-merge)

Scope (this PR)

This epic decomposes into a DAG of stories: #849 (its own issue — templates + audit expected-pin), A (scheduled fleet-wide deploy driver), B (standards-sync auto-merge through branch protection), C (audit enforces channel pin — coupled to #849), D (exemptions codified), and E (live fleet convergence). Stories A/B/E require live org mutation (branch-protection changes, fleet-wide deploys, canary tag moves) that must not be done autonomously from a dev-lead run, C is coupled to and should land with #849, and #849 has its own issue/run. This PR therefore implements the one story that is independent, in-repo, fully unit-testable, and non-org-mutating:

Story D (partial) — Exemptions codified: exempt repo-template from the feature-ideation-placeholder-context audit finding. repo-template's TODO:/Example: project_context is correct — it is the seed new repos customise — so flagging it is a false positive. The exemption is codified as an extensible registry + pure predicate rather than an inlined magic string.

The SKIP_REPOS-generalisation half of D and stories #849/A/B/C/E are called out as follow-ups (they need either their own issue, live org mutation, or coupling with #849).

Implementation Checklist

scripts/compliance-audit.sh — add PLACEHOLDER_CONTEXT_EXEMPT_REPOS array + pure predicate repo_is_placeholder_context_exempt <repo> (documented: why repo-template is exempt)
scripts/compliance-audit.sh — guard the feature-ideation-placeholder-context finding in check_required_workflows with the predicate

Tests to Write

test/scripts/compliance-audit/feature-ideation-placeholder-context.bats — repo-template is exempt (predicate returns 0)
same file — a normal repo (e.g. markets) is NOT exempt (predicate returns non-zero)
same file — the exempt registry is defined and contains repo-template

Test Command

./node_modules/.bin/bats test/scripts/compliance-audit/ + bash .dev-lead/scripts/dev-lead-lint.sh + shellcheck --severity=warning -x scripts/compliance-audit.sh

Dev-Lead: Implementation Complete

Scope note

Epic #850 is a DAG of stories. This PR delivers the one story that is independent, in-repo, fully unit-testable, and non-org-mutating: Story D (partial) — exempt repo-template from the feature-ideation-placeholder-context audit finding. repo-template's TODO:/Example: project_context is correct (it is the seed new repos customise), so the finding was a false positive. See follow-ups below for the rest of the epic.

Plan Execution

scripts/compliance-audit.sh — added PLACEHOLDER_CONTEXT_EXEMPT_REPOS registry + pure predicate repo_is_placeholder_context_exempt
scripts/compliance-audit.sh — guarded the feature-ideation-placeholder-context finding in check_required_workflows with the predicate
tests written first (red), then implementation (green)

Test Results

# ./node_modules/.bin/bats test/scripts/compliance-audit/feature-ideation-placeholder-context.bats
ok 5 repo-template is exempt from the placeholder-context finding
ok 6 a normal fleet repo is NOT exempt from the placeholder-context finding
ok 7 the empty repo name is NOT exempt
ok 8 the placeholder-context exemption registry is defined and lists repo-template
ok 9 check_required_workflows guards the placeholder finding with the exemption predicate
... 13/13 in file

# ./node_modules/.bin/bats test/scripts/compliance-audit/
173 tests, 0 failures

# shellcheck --severity=warning -x scripts/compliance-audit.sh  → OK
# bash .dev-lead/scripts/dev-lead-lint.sh                         → all checks passed

Files Changed

scripts/compliance-audit.sh: registry + pure predicate + guarded finding (exemptions codified, not inlined)
test/scripts/compliance-audit/feature-ideation-placeholder-context.bats: 5 new tests for the exemption

Notes / Follow-ups (rest of Epic #850)

Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849 (templates → @<agent>/v<M>-stable + audit expected-pin map) — has its own issue; the audit already accepts the major-scoped form (ring_major_form_acceptable).
Story C (audit enforces the channel pin — bare tag becomes a finding) — deliberately not shipped here: it is coupled to Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849. Enforcing v<M> before the templates emit it would flag every fresh seed. Should land with Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849.
Story D (other half) — generalising the deploy SKIP_REPOS opt-in (SKIP_OVERRIDES) is left as a follow-up; its exact target was ambiguous and risks overlap with Story A.
Stories A / B / E — the scheduled deploy driver, standards-sync auto-merge through branch protection, and live fleet convergence require live org mutation (branch-protection changes, fleet-wide deploys, canary tag moves) and were intentionally not performed from an autonomous dev-lead run.

feat: implement issue #856 — [#850 D] Codify SKIP_REPOS opt-in + exem…

feat: implement issue #852 — [#850 B] Auto-merge standards-sync PRs t…

feat: implement issue #860 — [#850 Phase 1a] Re-pin 13 caller-stub te…

feat: implement issue #861 — [#850 Phase 1b] Make compliance audit + …

feat: implement issue #851 — [#850 A] Automated standards-deploy driv…

feat: implement issue #864 — [#850] standards-deploy driver can't wri…

feat: implement issue #870 — [#850] standards-deploy driver deploys B…

feat: implement issue #868 — [#850] pr-auto-review dispatch strands P…

feat: implement issue #875 — [#850] templates drop the S7635 NOSONAR …

feat: implement issue #877 — [#850] make standards-deploy driver trea…

Epic #850 rollup — automation DELIVERED

Fully-automated fleet-wide version+channel shim compliance is built, validated, and operating. Stories delivered:

[#850 B] Auto-merge standards-sync PRs through branch protection (resolve the reviewer deadlock — no --admin) #852 (B) auto-merge primitive · [#850 D] Codify SKIP_REPOS opt-in + exempt repo-template from feature-ideation placeholder check #856 (D) exemptions · Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849 (I, split → [#850 Phase 1a] Re-pin 13 caller-stub templates to validated major-scoped v<M>-stable channels #860 templates→v-stable + [#850 Phase 1b] Make compliance audit + deploy compliance v<M>-stable-aware (flag bare tags) #861 v-form-aware audit/deploy) · [#850 A] Automated standards-deploy driver (scheduled fleet sweep → standards-sync PRs) #851 (A) scheduled deploy driver · [#850 E] Fleet convergence: sweep all repos to correct v<M>-stable channel pins via the automation (no manual runs) #857 (E) fleet convergence (core delivered).
Defects surfaced + fixed at source during rollout, each with a CI guard against recurrence: [#850] standards-deploy driver deploys BROKEN dev-lead pins (@dev-lead/v14-* has no tag — uses release major, not channel major) #870→feat: implement issue #870 — [#850] standards-deploy driver deploys BROKEN dev-lead pins (@dev-lead/v14-* has no tag — uses release major, not channel major) #871 (driver pinned release-major v14 instead of channel-major v1 — now asserts the tag exists), [#850] templates drop the S7635 NOSONAR marker on secrets: inherit (dev-lead/add-to-project/auto-rebase/dependabot-automerge) — restore + guard #875→feat: implement issue #875 — [#850] templates drop the S7635 NOSONAR marker on secrets: inherit (dev-lead/add-to-project/auto-rebase/dependabot-automerge) — restore + guard #876 (templates dropped the S7635 NOSONAR marker + guard bats), [#850] make standards-deploy driver treat a missing S7635 marker as drift (propagate #876 markers to already-pinned consumers) #877→feat: implement issue #877 — [#850] make standards-deploy driver treat a missing S7635 marker as drift (propagate #876 markers to already-pinned consumers) #878 (driver marker-aware: missing S7635 marker = drift), [#850] pr-auto-review dispatch strands PRs under bulk convergence — add a catch-up sweep + churn tolerance #868→feat: implement issue #868 — [#850] pr-auto-review dispatch strands PRs under bulk convergence — add a catch-up sweep + churn tolerance #869 (pr-auto-review catch-up sweep for bulk convergence).

Proven end-to-end: driver emits correct pins+markers → pr-review approves as donpetry-bot → native auto-merge, zero --admin on convergence PRs. 7 repos are uniformly max-quality.

Open follow-ups: #884 (finish #857 tail — 6 PRs blocked on CI-infra noise), #872 (sweep hardening), #879 (systemic in-place S7635 injection + test-9 harness fix), #883 (comment tier-token cosmetic). The one systemic item worth prioritizing: dev-lead leaves concurrency-cancelled dispatch/ci-relay checks on non-dev-lead PRs, which the review agent reads as failing CI and skips — the main thing gating the last few auto-merges.

feat: implement issue #886 — [#850] repo-template baseline re-seed pi…

feat: implement issue #884 — [#850] Finish #857 tail: 6 convergence P…

feat: implement issue #861 — [#850 Phase 1b] Make compliance audit + …

Closing after the 2026-10-21 backlog triage.

Why: Epic delivered; all stories (#849 #851 #852 #856 #857 #860 #861) closed.
Evidence: rollup comment 2026-07-22; sub-issues CLOSED

Reopen if this still reproduces on main.

Navigation Menu

Repository navigation

Epic: Fully-automated fleet-wide version+channel shim compliance (no manual deploy / admin-merge) #850

Goal

Principle

Dependency DAG

Sequencing (phased — minimizes bootstrap to a single admin-merge)

Epic-level acceptance (rollup)

Stories

Refs

Dev-Lead Implementation Plan

Scope (this PR)

Implementation Checklist

Tests to Write

Test Command

Dev-Lead: Implementation Complete

Scope note

Plan Execution

Test Results

Files Changed

Notes / Follow-ups (rest of Epic #850)

Epic #850 rollup — automation DELIVERED

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Epic: Fully-automated fleet-wide version+channel shim compliance (no manual deploy / admin-merge) #850

Description

Goal

Principle

Dependency DAG

Sequencing (phased — minimizes bootstrap to a single admin-merge)

Epic-level acceptance (rollup)

Stories

Refs

Activity

don-petry commented on Jul 21, 2026

don-petry commented on Jul 21, 2026

Dev-Lead Implementation Plan

Scope (this PR)

Implementation Checklist

Tests to Write

Test Command

don-petry commented on Jul 21, 2026

Dev-Lead: Implementation Complete

Scope note

Plan Execution

Test Results

Files Changed

Notes / Follow-ups (rest of Epic #850)

don-petry commented on Jul 22, 2026

Epic #850 rollup — automation DELIVERED

don-petry commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions