You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Story (B+A): standards + strip dev-lead trigger-edit sanction [#604] #605
Part of the shim-identity epic #604 — Story A + B (standards & sanction removal).
Centralized reusable-workflow caller stubs (dev-lead.yml, the RING shims) must be full-file identical across repos, modulo the per-repo ring/channel pin. Editing a shim's on:/permissions:/concurrency: surface is drift, not a repo-specific liberty. Today the stub header and the standard say the opposite, which is how broodminder-export#7 justified a trigger trim.
Changes (all in petry-projects/.github)
standards/workflows/dev-lead.yml — remove the header line "UNLIKE claude.yml, this file has NO OIDC byte-for-byte constraint and may be freely modified on PR branches to adjust triggers for repo-specific needs." Replace with a statement that the stub is copied verbatim and any diff (triggers included) is drift; behavior changes go through the reusable / a standards PR.
standards/ci-standards.md — in the centralization-tiers section and the Dev-Lead section, state explicitly that centralized shims are full-file identical modulo the tier channel pin; on:, permissions:, and concurrency: are not repo-adjustable. Cross-link #reusable-workflow-versioning--the-stable-channel.
Acceptance
No "freely modified / adjust triggers for repo-specific needs" language remains in the template or standard.
ci-standards.md states the full-file-identity rule and that triggers are not repo-adjustable.
Notes
The companion AGENTS.md / implementation-plan.md copies of the same sanction live in petry-projects/.github-private and are removed in the sibling story (D/A in .github-private).
Remove the "freely modified / adjust triggers for repo-specific needs" sanction from the dev-lead.yml stub template and state in ci-standards.md that Tier-1 shims are full-file identical modulo the tier channel pin — on:/permissions:/concurrency: are not repo-adjustable.
Implementation Checklist
standards/workflows/dev-lead.yml — replace the header lines "UNLIKE claude.yml … freely modified on PR branches to adjust triggers for repo-specific needs." with a verbatim-copy / any-diff-is-drift statement pointing behavior changes at the reusable / a standards PR.
standards/ci-standards.md (Centralization tiers §) — add the full-file-identity rule: Tier-1 shims are identical modulo the tier channel pin; on:/permissions:/concurrency: not repo-adjustable; cross-link #reusable-workflow-versioning--the-stable-channel.
standards/ci-standards.md (Dev-Lead §) — state explicitly the dev-lead stub is full-file identical modulo the channel pin and its trigger/permission/concurrency surface is not repo-adjustable; cross-link the stable-channel anchor.
Tests to Write
None — pure documentation change with no observable behavioral change (Phase 2 exception). Verification is the acceptance greps: no "freely modified / adjust triggers" language remains, and the standard states the full-file-identity + triggers-not-adjustable rule.
Test Command
bash ".dev-lead/scripts/dev-lead-lint.sh" plus npx markdownlint-cli2 on the changed docs (repo lint).
standards/workflows/dev-lead.yml — removed the "UNLIKE claude.yml … freely modified on PR branches to adjust triggers for repo-specific needs" sanction; replaced with a verbatim-copy / any-diff-is-drift statement that routes behavior changes to the reusable or a standards PR and cross-links #centralization-tiers + #reusable-workflow-versioning--the-stable-channel.
standards/ci-standards.md (Centralization tiers §) — added a Full-file identity (Tier 1) paragraph: shims are full-file identical modulo the tier channel pin; on:/permissions:/concurrency: are not repo-adjustable; cross-links the stable-channel anchor.
standards/ci-standards.md (Dev-Lead → Concurrency, pinning, and the permission contract §) — added a lead paragraph stating the dev-lead stub is a Tier-1 caller, full-file identical modulo the channel pin, with a non-repo-adjustable on:/permissions:/concurrency: surface; cross-links #centralization-tiers and the stable-channel anchor.
Test Results
Pure documentation change — no behavioral tests (Phase 2 exception). Verification via repo lint + acceptance greps:
[lint] shellcheck on 21 file(s)...
[lint] validating .github/CODEOWNERS...
OK: .github/CODEOWNERS
[lint] all checks passed
markdownlint-cli2 v0.23.0 (markdownlint v0.41.0)
Linting: 1 file(s) -> standards/ci-standards.md
Summary: 0 error(s)
AC1 (no sanction language in standards/): PASS — grep for "freely modified" / "adjust triggers for repo-specific needs" returns nothing
AC2 (full-file-identity + triggers not repo-adjustable stated in ci-standards.md): PASS — present in both the Centralization tiers § and the Dev-Lead § with the stable-channel cross-link
YAML OK (dev-lead.yml still parses; change is comment-only)
Files Changed
standards/workflows/dev-lead.yml: replaced the trigger-edit sanction header with a verbatim / drift statement + two cross-links.
standards/ci-standards.md: added the full-file-identity rule (triggers/permissions/concurrency not repo-adjustable) to the Centralization tiers § and the Dev-Lead §, each cross-linking the stable-channel section.
Notes
Scoped strictly to the two standards/ files named in the issue. This repo's own deployed .github/workflows/dev-lead.yml (a self-host ring0 canary that already legitimately drifts from the template) still carries the old header line; it was left untouched as out of scope — the epic notes companion copies of the sanction are removed in the sibling .github-private story (D/A).
The "Key differences from claude.yml" table row "OIDC byte-for-byte constraint | … | No" was left as-is: it describes claude.yml's OIDC identity gate (which dev-lead genuinely lacks), not the removed "freely modified" sanction, so it does not conflict with the new full-file-identity rule.
Activity
don-petry commentedon Jul 13, 2026
Dev-Lead Implementation Plan
Issue: #605 — Story (B+A): standards + strip dev-lead trigger-edit sanction [#604]
Scope
Remove the "freely modified / adjust triggers for repo-specific needs" sanction from the
dev-lead.ymlstub template and state inci-standards.mdthat Tier-1 shims are full-file identical modulo the tier channel pin —on:/permissions:/concurrency:are not repo-adjustable.Implementation Checklist
standards/workflows/dev-lead.yml— replace the header lines "UNLIKE claude.yml … freely modified on PR branches to adjust triggers for repo-specific needs." with a verbatim-copy / any-diff-is-drift statement pointing behavior changes at the reusable / a standards PR.standards/ci-standards.md(Centralization tiers §) — add the full-file-identity rule: Tier-1 shims are identical modulo the tier channel pin;on:/permissions:/concurrency:not repo-adjustable; cross-link#reusable-workflow-versioning--the-stable-channel.standards/ci-standards.md(Dev-Lead §) — state explicitly the dev-lead stub is full-file identical modulo the channel pin and its trigger/permission/concurrency surface is not repo-adjustable; cross-link the stable-channel anchor.Tests to Write
Test Command
bash ".dev-lead/scripts/dev-lead-lint.sh"plusnpx markdownlint-cli2on the changed docs (repo lint).don-petry commentedon Jul 13, 2026
Dev-Lead: Implementation Complete
Plan Execution
standards/workflows/dev-lead.yml— removed the "UNLIKE claude.yml … freely modified on PR branches to adjust triggers for repo-specific needs" sanction; replaced with a verbatim-copy / any-diff-is-drift statement that routes behavior changes to the reusable or a standards PR and cross-links#centralization-tiers+#reusable-workflow-versioning--the-stable-channel.standards/ci-standards.md(Centralization tiers §) — added a Full-file identity (Tier 1) paragraph: shims are full-file identical modulo the tier channel pin;on:/permissions:/concurrency:are not repo-adjustable; cross-links the stable-channel anchor.standards/ci-standards.md(Dev-Lead → Concurrency, pinning, and the permission contract §) — added a lead paragraph stating the dev-lead stub is a Tier-1 caller, full-file identical modulo the channel pin, with a non-repo-adjustableon:/permissions:/concurrency:surface; cross-links#centralization-tiersand the stable-channel anchor.Test Results
Pure documentation change — no behavioral tests (Phase 2 exception). Verification via repo lint + acceptance greps:
Files Changed
standards/workflows/dev-lead.yml: replaced the trigger-edit sanction header with a verbatim / drift statement + two cross-links.standards/ci-standards.md: added the full-file-identity rule (triggers/permissions/concurrency not repo-adjustable) to the Centralization tiers § and the Dev-Lead §, each cross-linking the stable-channel section.Notes
standards/files named in the issue. This repo's own deployed.github/workflows/dev-lead.yml(a self-host ring0 canary that already legitimately drifts from the template) still carries the old header line; it was left untouched as out of scope — the epic notes companion copies of the sanction are removed in the sibling.github-privatestory (D/A).claude.yml" table row "OIDC byte-for-byte constraint | … | No" was left as-is: it describes claude.yml's OIDC identity gate (which dev-lead genuinely lacks), not the removed "freely modified" sanction, so it does not conflict with the new full-file-identity rule.feat: implement issue #605 — Story (B+A): standards + strip dev-lead …