Round 1 (PR #48): codex-bot flagged the release-only bump described as a
one-line uses change while the same-tag rule two bullets up requires every
reference on one tag — a release-only setup has four (release caller +
three guards), so a one-line bump splits the consumer across versions.
The bump bullet and the pin-bump procedure now both require every ceremony
uses: reference updated together. Also the README called lib/decide.sh a
5-state table; the spec comment and rendered table have six rows.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extends the existing release-workflow / artifact-hook / labels sections
(from #27 and #39, kept intact) with the remaining adoption guide: the
greenfield bootstrap path, the box/rig/cast conversion checklist, the
exact-tag pinning policy, the portable changelog contributor rule, and
the agent-team-flow adoption checklist with the pin-bump procedure
(docs-sync documented from #19's contract).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
What a release is (the three stamps, box#108's two-edit rule), the two
doors, the decide table rendered for operators, the three guards with
their incidents, the drill doctrine, the verbatim refusal catalog with
cause and remedy, and the design lineage. Condensed from the box/rig/cast
CONTRIBUTING essays per #1 D8; every workflow-behavior claim links the
line or the spec issue.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Issue #12 writes the doctrine into README.md; the extensionless
placeholder was the 12-byte stub triage's readiness note called out.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
drills/0.1.0.md — six probes plus (g), run on the disposable scratch repo
against the candidate SHA, every refusal checked for droppings; the pin
deviation (fork ref, CEREMONY_SELF_REF -> candidate SHA in both carriers)
recorded under its own heading per triage's ruling on #11. drills/README.md
gains the first-release caveat that ruling asked for: the first drill can
never take the pure pinned consumer path, and must not fix that by putting
a tag-shaped branch in the canonical ref namespace.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The ceremony PR — two edits, per the amended #11: VERSION 0.1.0-dev -> 0.1.0,
and the changelog stamp with the re-arm in the same edit (## Unreleased ->
## 0.1.0 — 2026-07-22, an empty ## Unreleased put back on top — box#108).
No third stamp: both CEREMONY_SELF_REF carriers already read "0.1.0", and
self-ref-check's bare-tree rule wants exactly that. drills/0.1.0.md follows
once the rehearsal runs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
VERSION at 0.1.0-dev, the armed CHANGELOG.md, drills/README.md (what a
drill means here), the self-callers (self-release.yml, self-labels.yml —
local uses:, the one form consumers must never copy), .github/labeler.yml
for the scope job, and the three self-guards in CI. labels.yml gains the
self-consumption bypass (release.yml's twin) so the label bootstrap can run
before any release tag exists; action-exercise's armed/drill-recorded
scratch steps move to self-guards per their own eviction note.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round 1 (PR #43): codex-bot + kimi-bot reproduced cp writing through a
committed symlink and cmp/find resolving through or skipping link nodes —
both modes now refuse any non-regular node (.ceremony itself, anything
under it, the root AGENTS.md incl. dangling links and non-file nodes)
before touching the tree. kimi-bot also found .ceremony/README.md was
machine-written but never machine-verified: --check now cmps it against
the generated text (missing or drifted -> red). 22 regression rows; every
symlink row asserts the victim untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The fixture consumer is the workspace root (a uses: step cannot cd);
ceremony rides a subdirectory checkout serving as both the local action
ref and the --source override. CONSUMERS.md gains the wiring, bootstrap,
and pin-bump procedure (#12's section, amended in the same cycle).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fake source trees (not the real five docs) so a hardcoded list fails;
consumer trees per pin shape, including the commented-pin row ceremony's
own release.yml header motivates. Also fixes the EXIT-trap exit-status
clobber the smoke run surfaced.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The materialization machinery for doctrine (issue #19): docs are vendored
into consumers at .ceremony/, machine-written (--fix) and machine-verified
(--check), keyed on the single release.yml pin line.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port box's drill-recorded.sh (the origin of the three copies) as a
composite action on the #5 pattern: version read through lib/version.sh,
one file per version under drills/, whitespace-only records refused.
Keyed on the tree's version — -dev trees pass with a notice that says
why nothing was asserted; bare trees must show drills/<version>.md with
at least one non-whitespace character.
Closes#7
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The action-exercise job commits a scratch base, marks it as an in-job
fixture branch, commits an insert-above edit, and runs the composite
action against that history — proving the wiring AND a genuine
merge-base comparison, not just an action.yml parse. Base ref passed
explicitly: the shallow PR checkout has no origin/main to resolve.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every case from #6's test list: the documented-flow passes (insert-above,
the stamp, prose-only), the box#122 deletion shape, the box#118 duplicate
(proven to run before every history gate, the box#143 ordering), rc
distinctness, both STRICT degradations, the file-first-added edge, the
vacuous push-to-main shape, and the action's env wiring.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port of box's changelog-monotonic.sh (box#122, caught in review of
box#118) as a composite action, folding in cast's port notes (cast#133).
Uniqueness on HEAD runs before anything that needs history (box#143);
containment degrades loudly, and the action defaults strict to 1 so CI
can never take the skip path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round 1's shared blocking catch: release-exercise's call job proves the
parse but executes no steps (both doors are push-gated, by design), and
fixture-chain drives the scripts, not the workflow. The new step-replay
job executes the merge door's early sequence for real — both checkout
shapes including path: .ceremony-src, both branches of the bypass via a
matrix standing in for the repository test, the CEREMONY_DIR wiring, and
facts → decide → notes through genuine $GITHUB_OUTPUT plumbing — against
a fixture tree with a stubbed gh. Wired into PR CI as standing evidence;
PR-only, because a push-to-main workflow_call would hand release.yml the
merge door's exact gate. release.yml's honest-gap paragraph narrows to
what stays untested until #11: the doors themselves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A descriptive snapshot of how the five-box fleet actually runs: the roster
table, the duty-loop skeleton (cron + flock + poll + one-shot sessions),
wake conditions per role, the resilience layer (boot gate, crash-only
resume, checkpoint discipline, worktree isolation), and board conventions.
Explicitly not doctrine and not vendored: it exists so the current setups
can later be captured in detail per-agent and converged into a reusable
fleet-management solution.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closes#9. .github/workflows/release.yml (workflow_call) replaces box's,
rig's and cast's release.yml: the merge door (facts -> decide -> notes ->
tag+publish+bump, every decision in a tested lib script) and the tag door
(the manual fallback and backfill, no bump). Plus lib/facts.sh (the merge
door's impure half, contract-tested against fixture repos with a stubbed
gh), the self-ref pin guard (.github/scripts/self-ref-check.sh + CI step +
tests), the release-exercise scratch caller (dry wiring), the end-to-end
script-chain rehearsal, and the caller + artifact-hook contracts in
docs/CONSUMERS.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port box's changelog-armed.sh as the first composite action, establishing
the pattern #6 and #7 copy: action.yml passes inputs as env vars, the
co-located script stays directly runnable, and the shared libs are sourced
relative to the action so they travel with it at the consumer's pinned ref.
Port deltas per issue #5: the version goes through version_read (#3) so the
guard works for package-json trees, and the bare-version emptiness check
consults changelog_section (#4) — the guard and the publisher cannot
disagree about what a section is. Messages and the header essay keep the
box#108 / rig#66 / rig#44 / cast#108 history; this is the guard rig and
cast regain at adoption.
CI gains an action-exercise job driving uses: ./actions/changelog-armed
against a scratch armed tree — the composite wiring proven, not just the
script.
Closes#5
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The six-row decision table from issue #8 as a pure script: the workflow
gathers facts (VER, BASE_VER, RELEASED, LABELED), this script decides.
Notices/refusals ported near-verbatim from box's decide step, de-repo-ified;
design lineage box#96 / rig#47 / cast#111.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The seam that lets box/rig/incubator (a VERSION file) and cast
(package.json + lockfile sync) share every other ceremony component
unchanged. Sourced, pure (no git), fail-loud on every unreadable state.
Carries cast's pkg_version discipline (node's parser, never regex) and
its lockfile-only bump incantation; refuses pre-release arithmetic
(-dev/-rc1) per box's prefix-confusion lore. The npm-backed write test
skips locally without npm but CI sets CEREMONY_REQUIRE_NPM so the skip
is a failure there — the case can never quietly stop running.
Closes#3
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Four files under .github/: the new-issue interception (blank issues off,
Discussions link first), the work-order form mirroring TRIAGE.md's issue
contract with stable headings for #18 to parse, the PR template carrying
BUILDER.md's checklist, and light optional-only discussion forms for Ideas
and Q&A. No template applies any label — queue labels stay triage's
explicit act (LABELS.md).
Closes#24
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Label definitions need write; the agents team is triage on purpose, and
the Actions GITHUB_TOKEN is how the family converges label taxonomies
without granting any agent identity write (box/rig/cast labels.yml
precedent). Deletable the day #10 lands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dan-claude-bot takes triage (the single issue-writer, auditable by
actor); claude/codex split building by terrain (machinery vs mechanical);
grok and kimi review; the panel for any PR is everyone except its author.
One box per identity — the box is the credential boundary, the session
prompt is the role boundary.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
'You are a reviewer here' becomes a sufficient launch prompt: agent
harnesses auto-load root AGENTS.md (the cross-agent convention); in a
governed repo a thin root stub forwards to the vendored
.ceremony/AGENTS.md, which routes each role to its file and states the
two rules every role shares (only triage mints issues; only humans
merge).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Workflows are consumed by reference because GitHub materializes them at
run time; docs have no runtime — agents read the working tree — so the
agent-facing set (TRIAGE, BUILDER, REVIEWER, LABELS) vendors into each
governed repo at .ceremony/, byte-identical to the pinned ref and guarded
by docs-sync --check in CI (#19). Role files made self-contained for
vendored reading.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
