Skip to content

Story (B+A): standards + strip dev-lead trigger-edit sanction [#604] #605

Closed

Description

@don-petry

Part of the shim-identity epic #604 — Story A + B (standards & sanction removal).

Centralized reusable-workflow caller stubs (dev-lead.yml, the RING shims) must be full-file identical across repos, modulo the per-repo ring/channel pin. Editing a shim's on:/permissions:/concurrency: surface is drift, not a repo-specific liberty. Today the stub header and the standard say the opposite, which is how broodminder-export#7 justified a trigger trim.

Changes (all in petry-projects/.github)

  • standards/workflows/dev-lead.yml — remove the header line "UNLIKE claude.yml, this file has NO OIDC byte-for-byte constraint and may be freely modified on PR branches to adjust triggers for repo-specific needs." Replace with a statement that the stub is copied verbatim and any diff (triggers included) is drift; behavior changes go through the reusable / a standards PR.
  • standards/ci-standards.md — in the centralization-tiers section and the Dev-Lead section, state explicitly that centralized shims are full-file identical modulo the tier channel pin; on:, permissions:, and concurrency: are not repo-adjustable. Cross-link #reusable-workflow-versioning--the-stable-channel.

Acceptance

  • No "freely modified / adjust triggers for repo-specific needs" language remains in the template or standard.
  • ci-standards.md states the full-file-identity rule and that triggers are not repo-adjustable.

Notes

  • The companion AGENTS.md / implementation-plan.md copies of the same sanction live in petry-projects/.github-private and are removed in the sibling story (D/A in .github-private).

Activity

  1. don-petry commented on Jul 13, 2026

    @don-petry
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #605 — Story (B+A): standards + strip dev-lead trigger-edit sanction [#604]

    Scope

    Remove the "freely modified / adjust triggers for repo-specific needs" sanction from the dev-lead.yml stub template and state in ci-standards.md that Tier-1 shims are full-file identical modulo the tier channel pin — on:/permissions:/concurrency: are not repo-adjustable.

    Implementation Checklist

    • standards/workflows/dev-lead.yml — replace the header lines "UNLIKE claude.yml … freely modified on PR branches to adjust triggers for repo-specific needs." with a verbatim-copy / any-diff-is-drift statement pointing behavior changes at the reusable / a standards PR.
    • standards/ci-standards.md (Centralization tiers §) — add the full-file-identity rule: Tier-1 shims are identical modulo the tier channel pin; on:/permissions:/concurrency: not repo-adjustable; cross-link #reusable-workflow-versioning--the-stable-channel.
    • standards/ci-standards.md (Dev-Lead §) — state explicitly the dev-lead stub is full-file identical modulo the channel pin and its trigger/permission/concurrency surface is not repo-adjustable; cross-link the stable-channel anchor.

    Tests to Write

    • None — pure documentation change with no observable behavioral change (Phase 2 exception). Verification is the acceptance greps: no "freely modified / adjust triggers" language remains, and the standard states the full-file-identity + triggers-not-adjustable rule.

    Test Command

    bash ".dev-lead/scripts/dev-lead-lint.sh" plus npx markdownlint-cli2 on the changed docs (repo lint).

  2. don-petry commented on Jul 13, 2026

    @don-petry
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • standards/workflows/dev-lead.yml — removed the "UNLIKE claude.yml … freely modified on PR branches to adjust triggers for repo-specific needs" sanction; replaced with a verbatim-copy / any-diff-is-drift statement that routes behavior changes to the reusable or a standards PR and cross-links #centralization-tiers + #reusable-workflow-versioning--the-stable-channel.
    • standards/ci-standards.md (Centralization tiers §) — added a Full-file identity (Tier 1) paragraph: shims are full-file identical modulo the tier channel pin; on:/permissions:/concurrency: are not repo-adjustable; cross-links the stable-channel anchor.
    • standards/ci-standards.md (Dev-Lead → Concurrency, pinning, and the permission contract §) — added a lead paragraph stating the dev-lead stub is a Tier-1 caller, full-file identical modulo the channel pin, with a non-repo-adjustable on:/permissions:/concurrency: surface; cross-links #centralization-tiers and the stable-channel anchor.

    Test Results

    Pure documentation change — no behavioral tests (Phase 2 exception). Verification via repo lint + acceptance greps:

    [lint] shellcheck on 21 file(s)...
      [lint] validating .github/CODEOWNERS...
    OK: .github/CODEOWNERS
      [lint] all checks passed
    
    markdownlint-cli2 v0.23.0 (markdownlint v0.41.0)
    Linting: 1 file(s)  ->  standards/ci-standards.md
    Summary: 0 error(s)
    
    AC1 (no sanction language in standards/): PASS — grep for "freely modified" / "adjust triggers for repo-specific needs" returns nothing
    AC2 (full-file-identity + triggers not repo-adjustable stated in ci-standards.md): PASS — present in both the Centralization tiers § and the Dev-Lead § with the stable-channel cross-link
    
    YAML OK (dev-lead.yml still parses; change is comment-only)
    

    Files Changed

    • standards/workflows/dev-lead.yml: replaced the trigger-edit sanction header with a verbatim / drift statement + two cross-links.
    • standards/ci-standards.md: added the full-file-identity rule (triggers/permissions/concurrency not repo-adjustable) to the Centralization tiers § and the Dev-Lead §, each cross-linking the stable-channel section.

    Notes

    • Scoped strictly to the two standards/ files named in the issue. This repo's own deployed .github/workflows/dev-lead.yml (a self-host ring0 canary that already legitimately drifts from the template) still carries the old header line; it was left untouched as out of scope — the epic notes companion copies of the sanction are removed in the sibling .github-private story (D/A).
    • The "Key differences from claude.yml" table row "OIDC byte-for-byte constraint | … | No" was left as-is: it describes claude.yml's OIDC identity gate (which dev-lead genuinely lacks), not the removed "freely modified" sanction, so it does not conflict with the new full-file-identity rule.
  3. added a commit that references this issue on Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    dev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions