Merge remote-tracking branch 'origin/main' into dublin-v2

# Conflicts:
#	CHANGELOG.md
#	VERSION
#	agents-digest/gstack-AGENTS.md
#	office-hours/SKILL.md
#	package.json
#	plan-ceo-review/sections/review-sections.md
#	plan-devex-review/sections/review-sections.md
#	plan-eng-review/sections/review-sections.md
#	review/sections/adversarial.md
#	scripts/resolvers/review.ts
#	ship/sections/adversarial.md
#	test/fixtures/golden/factory-ship-SKILL.md
#	test/helpers/carve-guards.ts
This commit is contained in:
Garry Tan
2026-09-01 20:16:18 +00:00
151 changed files with 5955 additions and 3234 deletions
+11 -6
View File
@@ -177,7 +177,7 @@ the PR (a live-format credential inside the fence still blocks).
REDACT_VIS=$(~/.claude/skills/gstack/bin/gstack-config get redact_repo_visibility 2>/dev/null)
[ -z "$REDACT_VIS" ] && REDACT_VIS=$(gh repo view --json visibility -q .visibility 2>/dev/null | tr 'A-Z' 'a-z')
REDACT_VIS="${REDACT_VIS:-unknown}"
PR_BODY_FILE=$(mktemp)
PR_BODY_FILE=$(mktemp) || { echo "ERROR: mktemp failed — cannot scan the PR body; refusing to create the PR unscanned." >&2; exit 1; }
cat > "$PR_BODY_FILE" <<'PR_BODY_EOF'
<PR body from above>
PR_BODY_EOF
@@ -193,11 +193,14 @@ printf '%s' "v$NEW_VERSION <type>: <summary>" | ~/.claude/skills/gstack/bin/gsta
HIGH blocks (exit 3, no skip). MEDIUM → AskUserQuestion (PII subset offers
`--auto-redact`). Same scan runs before the `gh pr edit --body` path (Step 17).
**If GitHub:** create from the SCANNED file (exact bytes scanned = bytes sent):
**If GitHub:** create from the SCANNED file (exact bytes scanned = bytes sent).
`$PR_BODY_FILE` comes from the scan block above — restate it in this shell if
blocks ran separately, and never proceed with an empty file:
```bash
# PR title MUST start with v$NEW_VERSION — enforced on every run, no exceptions.
# (See Step 19 idempotency block + bin/gstack-pr-title-rewrite.sh for the rule.)
[ -s "$PR_BODY_FILE" ] || { echo "ERROR: scanned body file missing/empty — re-run the scan block." >&2; exit 1; }
gh pr create --base <base> --title "v$NEW_VERSION <type>: <summary>" --body-file "$PR_BODY_FILE"
rm -f "$PR_BODY_FILE"
```
@@ -207,10 +210,12 @@ rm -f "$PR_BODY_FILE"
```bash
# MR title MUST start with v$NEW_VERSION — enforced on every run, no exceptions.
# (See Step 19 idempotency block + bin/gstack-pr-title-rewrite.sh for the rule.)
glab mr create -b <base> -t "v$NEW_VERSION <type>: <summary>" -d "$(cat <<'EOF'
<MR body from above>
EOF
)"
# Send the SCANNED file's bytes — scan-at-sink means never re-render the body
# from a fresh heredoc (that reopens the scan-vs-send gap). $PR_BODY_FILE comes
# from the scan block above; never proceed with an empty file.
[ -s "$PR_BODY_FILE" ] || { echo "ERROR: scanned body file missing/empty — re-run the scan block." >&2; exit 1; }
glab mr create -b <base> -t "v$NEW_VERSION <type>: <summary>" -d "$(cat "$PR_BODY_FILE")"
rm -f "$PR_BODY_FILE"
```
**If neither CLI is available:**