Epic: Fully-automated fleet-wide version+channel shim compliance (no manual deploy / admin-merge)

[don-petry]

Goal

Every repo carries every required caller-stub shim, pinned to its agent's moving major-scoped channel @<agent>/v<M>-stable, so a new reusable version reaches the whole fleet by a canary tag move — never a redeploy. Placement and drift-correction are fully automated by the existing systems; no manual deploy-standard-workflows.sh runs and no admin-merge.

Principle

The 2026-07-21 rollout (#844/#847) was hand-driven (manual sweeps, --admin, quarantine). That fought the systems. The version+channel model + canary rollout + compliance audit already exist; the gaps are two missing automation pieces (a deployer and an auto-merge path). Improve the systems; do not supersede them.

Dependency DAG

graph LR
  B["#852 · B: standards-sync auto-merge<br/>(bootstrap: 1× admin-merge)"]
  I["#849 · templates → v&lt;M&gt;-stable + audit pin-check"]
  A["#851 · A: automated deploy driver"]
  D["#856 · D: SKIP_REPOS opt-in + repo-template exemption"]
  E["#857 · E: fleet convergence (via automation)"]
  B --> I
  B --> A
  B --> D
  I --> A
  I --> D
  A --> E
  D --> E
  B --> E

Loading

Sequencing (phased — minimizes bootstrap to a single admin-merge)

Phase	Story	Depends on	Merges via	Acceptance (one-line)
0 — bootstrap	#852 (B) auto-merge	—	admin-merge (the one unavoidable bootstrap)	A standards-sync PR with green required checks merges through branch protection, no --admin
1 — foundation	#849 templates + audit pin	#852 (to auto-merge)	auto-merge (#852)	All 13 stale templates pin their agent's current @<agent>/v<M>-stable; audit flags any bare-tag/off-channel pin
2 — automation (parallel)	#851 (A) deploy driver	#849, #852	auto-merge (#852)	Scheduled+dispatch workflow sweeps drift → standards-sync PRs; compliant repos untouched
	#856 (D) exemptions	#849, #852	auto-merge (#852)	repo-template no longer flagged for placeholder; SKIP_REPOS opt-in codified + tested
3 — converge	#857 (E) fleet convergence	#849, #851, #852, #856	driven by #851 + #852	Audit reports 0 missing + 0 wrong-channel findings fleet-wide; ContentTwin bats passes against the deployed stub; no manual runs

Bootstrap note (approved): only #852 needs an admin-merge (you can't auto-merge the fix that creates auto-merge). Once #852 lands, #849/#851/#856 auto-merge through the system, and #857 runs entirely on the automation.

Epic-level acceptance (rollup)

• A reusable version cut reaches the fleet by a canary tag move alone (no shim redeploy) — spot-checked.
• The scheduled deploy driver + auto-merge converge any drift with zero manual intervention (no --admin, no quarantine) after the [#850 B] Auto-merge standards-sync PRs through branch protection (resolve the reviewer deadlock — no --admin) #852 bootstrap.
• Compliance audit: every repo present + correctly channel-pinned; ContentTwin's add-to-project-workflow.bats green against the deployed stub.
• Templates, audit, deploy, and canary agree on the version+channel model end-to-end.

Stories

• Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849 — templates → major-scoped channel pins + audit pin-check (foundation; also story C)
• [#850 A] Automated standards-deploy driver (scheduled fleet sweep → standards-sync PRs) #851 — A: automated standards-deploy driver
• [#850 B] Auto-merge standards-sync PRs through branch protection (resolve the reviewer deadlock — no --admin) #852 — B: standards-sync auto-merge (resolve reviewer deadlock)
• [#850 D] Codify SKIP_REPOS opt-in + exempt repo-template from feature-ideation placeholder check #856 — D: SKIP_REPOS opt-in + repo-template placeholder exemption
• [#850 E] Fleet convergence: sweep all repos to correct v<M>-stable channel pins via the automation (no manual runs) #857 — E: fleet convergence via the automation

Refs

#657 (major-scoped channels), #849 (templates), #847/#848 (SKIP_REPOS reconcile), #844 (required-everywhere).

[don-petry]

Stories filed: #849 (templates), #851 (deploy driver, story A), #852 (auto-merge, story B). Story C folds into #849 (audit pin-check); D (exemptions) extends #847 + repo-template placeholder; E (fleet convergence) is the gated run once A–D + #849 land — driven by the deploy driver + auto-merge, verified by the audit, no manual sweeps.

[don-petry]

Dev-Lead Implementation Plan

Issue: #850 — Epic: Fully-automated fleet-wide version+channel shim compliance (no manual deploy / admin-merge)

Scope (this PR)

This epic decomposes into a DAG of stories: #849 (its own issue — templates + audit expected-pin), A (scheduled fleet-wide deploy driver), B (standards-sync auto-merge through branch protection), C (audit enforces channel pin — coupled to #849), D (exemptions codified), and E (live fleet convergence). Stories A/B/E require live org mutation (branch-protection changes, fleet-wide deploys, canary tag moves) that must not be done autonomously from a dev-lead run, C is coupled to and should land with #849, and #849 has its own issue/run. This PR therefore implements the one story that is independent, in-repo, fully unit-testable, and non-org-mutating:

Story D (partial) — Exemptions codified: exempt repo-template from the feature-ideation-placeholder-context audit finding. repo-template's TODO:/Example: project_context is correct — it is the seed new repos customise — so flagging it is a false positive. The exemption is codified as an extensible registry + pure predicate rather than an inlined magic string.

The SKIP_REPOS-generalisation half of D and stories #849/A/B/C/E are called out as follow-ups (they need either their own issue, live org mutation, or coupling with #849).

Implementation Checklist

• scripts/compliance-audit.sh — add PLACEHOLDER_CONTEXT_EXEMPT_REPOS array + pure predicate repo_is_placeholder_context_exempt <repo> (documented: why repo-template is exempt)
• scripts/compliance-audit.sh — guard the feature-ideation-placeholder-context finding in check_required_workflows with the predicate

Tests to Write

• test/scripts/compliance-audit/feature-ideation-placeholder-context.bats — repo-template is exempt (predicate returns 0)
• same file — a normal repo (e.g. markets) is NOT exempt (predicate returns non-zero)
• same file — the exempt registry is defined and contains repo-template

Test Command

./node_modules/.bin/bats test/scripts/compliance-audit/ + bash .dev-lead/scripts/dev-lead-lint.sh + shellcheck --severity=warning -x scripts/compliance-audit.sh

[don-petry]

Dev-Lead: Implementation Complete

Scope note

Epic #850 is a DAG of stories. This PR delivers the one story that is independent, in-repo, fully unit-testable, and non-org-mutating: Story D (partial) — exempt repo-template from the feature-ideation-placeholder-context audit finding. repo-template's TODO:/Example: project_context is correct (it is the seed new repos customise), so the finding was a false positive. See follow-ups below for the rest of the epic.

Plan Execution

• scripts/compliance-audit.sh — added PLACEHOLDER_CONTEXT_EXEMPT_REPOS registry + pure predicate repo_is_placeholder_context_exempt
• scripts/compliance-audit.sh — guarded the feature-ideation-placeholder-context finding in check_required_workflows with the predicate
• tests written first (red), then implementation (green)

Test Results

# ./node_modules/.bin/bats test/scripts/compliance-audit/feature-ideation-placeholder-context.bats
ok 5 repo-template is exempt from the placeholder-context finding
ok 6 a normal fleet repo is NOT exempt from the placeholder-context finding
ok 7 the empty repo name is NOT exempt
ok 8 the placeholder-context exemption registry is defined and lists repo-template
ok 9 check_required_workflows guards the placeholder finding with the exemption predicate
... 13/13 in file

# ./node_modules/.bin/bats test/scripts/compliance-audit/
173 tests, 0 failures

# shellcheck --severity=warning -x scripts/compliance-audit.sh  → OK
# bash .dev-lead/scripts/dev-lead-lint.sh                         → all checks passed

Files Changed

• scripts/compliance-audit.sh: registry + pure predicate + guarded finding (exemptions codified, not inlined)
• test/scripts/compliance-audit/feature-ideation-placeholder-context.bats: 5 new tests for the exemption

Notes / Follow-ups (rest of Epic #850)

• Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849 (templates → @<agent>/v<M>-stable + audit expected-pin map) — has its own issue; the audit already accepts the major-scoped form (ring_major_form_acceptable).
• Story C (audit enforces the channel pin — bare tag becomes a finding) — deliberately not shipped here: it is coupled to Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849. Enforcing v<M> before the templates emit it would flag every fresh seed. Should land with Standard templates pin retiring bare <agent>/stable tags — migrate to major-scoped v<M>-stable channels (#657) #849.
• Story D (other half) — generalising the deploy SKIP_REPOS opt-in (SKIP_OVERRIDES) is left as a follow-up; its exact target was ambiguous and risks overlap with Story A.
• Stories A / B / E — the scheduled deploy driver, standards-sync auto-merge through branch protection, and live fleet convergence require live org mutation (branch-protection changes, fleet-wide deploys, canary tag moves) and were intentionally not performed from an autonomous dev-lead run.