Round 1 (PR #43): codex-bot + kimi-bot reproduced cp writing through a
committed symlink and cmp/find resolving through or skipping link nodes —
both modes now refuse any non-regular node (.ceremony itself, anything
under it, the root AGENTS.md incl. dangling links and non-file nodes)
before touching the tree. kimi-bot also found .ceremony/README.md was
machine-written but never machine-verified: --check now cmps it against
the generated text (missing or drifted -> red). 22 regression rows; every
symlink row asserts the victim untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The fixture consumer is the workspace root (a uses: step cannot cd);
ceremony rides a subdirectory checkout serving as both the local action
ref and the --source override. CONSUMERS.md gains the wiring, bootstrap,
and pin-bump procedure (#12's section, amended in the same cycle).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fake source trees (not the real five docs) so a hardcoded list fails;
consumer trees per pin shape, including the commented-pin row ceremony's
own release.yml header motivates. Also fixes the EXIT-trap exit-status
clobber the smoke run surfaced.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The materialization machinery for doctrine (issue #19): docs are vendored
into consumers at .ceremony/, machine-written (--fix) and machine-verified
(--check), keyed on the single release.yml pin line.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The action-exercise job commits a scratch base, marks it as an in-job
fixture branch, commits an insert-above edit, and runs the composite
action against that history — proving the wiring AND a genuine
merge-base comparison, not just an action.yml parse. Base ref passed
explicitly: the shallow PR checkout has no origin/main to resolve.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every case from #6's test list: the documented-flow passes (insert-above,
the stamp, prose-only), the box#122 deletion shape, the box#118 duplicate
(proven to run before every history gate, the box#143 ordering), rc
distinctness, both STRICT degradations, the file-first-added edge, the
vacuous push-to-main shape, and the action's env wiring.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port of box's changelog-monotonic.sh (box#122, caught in review of
box#118) as a composite action, folding in cast's port notes (cast#133).
Uniqueness on HEAD runs before anything that needs history (box#143);
containment degrades loudly, and the action defaults strict to 1 so CI
can never take the skip path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round 1's shared blocking catch: release-exercise's call job proves the
parse but executes no steps (both doors are push-gated, by design), and
fixture-chain drives the scripts, not the workflow. The new step-replay
job executes the merge door's early sequence for real — both checkout
shapes including path: .ceremony-src, both branches of the bypass via a
matrix standing in for the repository test, the CEREMONY_DIR wiring, and
facts → decide → notes through genuine $GITHUB_OUTPUT plumbing — against
a fixture tree with a stubbed gh. Wired into PR CI as standing evidence;
PR-only, because a push-to-main workflow_call would hand release.yml the
merge door's exact gate. release.yml's honest-gap paragraph narrows to
what stays untested until #11: the doors themselves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A descriptive snapshot of how the five-box fleet actually runs: the roster
table, the duty-loop skeleton (cron + flock + poll + one-shot sessions),
wake conditions per role, the resilience layer (boot gate, crash-only
resume, checkpoint discipline, worktree isolation), and board conventions.
Explicitly not doctrine and not vendored: it exists so the current setups
can later be captured in detail per-agent and converged into a reusable
fleet-management solution.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closes#9. .github/workflows/release.yml (workflow_call) replaces box's,
rig's and cast's release.yml: the merge door (facts -> decide -> notes ->
tag+publish+bump, every decision in a tested lib script) and the tag door
(the manual fallback and backfill, no bump). Plus lib/facts.sh (the merge
door's impure half, contract-tested against fixture repos with a stubbed
gh), the self-ref pin guard (.github/scripts/self-ref-check.sh + CI step +
tests), the release-exercise scratch caller (dry wiring), the end-to-end
script-chain rehearsal, and the caller + artifact-hook contracts in
docs/CONSUMERS.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port box's changelog-armed.sh as the first composite action, establishing
the pattern #6 and #7 copy: action.yml passes inputs as env vars, the
co-located script stays directly runnable, and the shared libs are sourced
relative to the action so they travel with it at the consumer's pinned ref.
Port deltas per issue #5: the version goes through version_read (#3) so the
guard works for package-json trees, and the bare-version emptiness check
consults changelog_section (#4) — the guard and the publisher cannot
disagree about what a section is. Messages and the header essay keep the
box#108 / rig#66 / rig#44 / cast#108 history; this is the guard rig and
cast regain at adoption.
CI gains an action-exercise job driving uses: ./actions/changelog-armed
against a scratch armed tree — the composite wiring proven, not just the
script.
Closes#5
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The six-row decision table from issue #8 as a pure script: the workflow
gathers facts (VER, BASE_VER, RELEASED, LABELED), this script decides.
Notices/refusals ported near-verbatim from box's decide step, de-repo-ified;
design lineage box#96 / rig#47 / cast#111.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The seam that lets box/rig/incubator (a VERSION file) and cast
(package.json + lockfile sync) share every other ceremony component
unchanged. Sourced, pure (no git), fail-loud on every unreadable state.
Carries cast's pkg_version discipline (node's parser, never regex) and
its lockfile-only bump incantation; refuses pre-release arithmetic
(-dev/-rc1) per box's prefix-confusion lore. The npm-backed write test
skips locally without npm but CI sets CEREMONY_REQUIRE_NPM so the skip
is a failure there — the case can never quietly stop running.
Closes#3
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Four files under .github/: the new-issue interception (blank issues off,
Discussions link first), the work-order form mirroring TRIAGE.md's issue
contract with stable headings for #18 to parse, the PR template carrying
BUILDER.md's checklist, and light optional-only discussion forms for Ideas
and Q&A. No template applies any label — queue labels stay triage's
explicit act (LABELS.md).
Closes#24
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Label definitions need write; the agents team is triage on purpose, and
the Actions GITHUB_TOKEN is how the family converges label taxonomies
without granting any agent identity write (box/rig/cast labels.yml
precedent). Deletable the day #10 lands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dan-claude-bot takes triage (the single issue-writer, auditable by
actor); claude/codex split building by terrain (machinery vs mechanical);
grok and kimi review; the panel for any PR is everyone except its author.
One box per identity — the box is the credential boundary, the session
prompt is the role boundary.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
'You are a reviewer here' becomes a sufficient launch prompt: agent
harnesses auto-load root AGENTS.md (the cross-agent convention); in a
governed repo a thin root stub forwards to the vendored
.ceremony/AGENTS.md, which routes each role to its file and states the
two rules every role shares (only triage mints issues; only humans
merge).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Workflows are consumed by reference because GitHub materializes them at
run time; docs have no runtime — agents read the working tree — so the
agent-facing set (TRIAGE, BUILDER, REVIEWER, LABELS) vendors into each
governed repo at .ceremony/, byte-identical to the pinned ref and guarded
by docs-sync --check in CI (#19). Role files made self-contained for
vendored reading.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Discussions are where intent lives; issues are minted only by triage;
builders turn one issue into one PR; reviewers converge on verdicts;
humans decide in the discussion and at the merge. LABELS.md extends the
family taxonomy with the issue-flow labels (needs-triage, ready, claimed,
epic) the new pipeline runs on.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
