ci: promote next to main

.claude-plugin/marketplace.json

@@ -12,49 +12,56 @@
       "source": "./plugins/aidd-context",
       "description": "Knowledge production: project bootstrap, project init, generation of context artifacts (skills, agents, rules, commands, hooks), mermaid diagrams, learn, discovery",
       "strict": true,
-      "recommended": true
+      "metadata": { "recommended": true }
     },
     {
       "name": "aidd-dev",
       "source": "./plugins/aidd-dev",
       "description": "Code transformation: plan, implement, assert, audit, review, test, refactor, debug, for-sure. Hosts engineering agents.",
       "strict": true,
-      "recommended": true
+      "metadata": { "recommended": true }
     },
     {
       "name": "aidd-vcs",
       "source": "./plugins/aidd-vcs",
       "description": "External artifacts: commit, pull-request, release-tag, issue-create",
       "strict": true,
-      "recommended": true
+      "metadata": { "recommended": true }
     },
     {
       "name": "aidd-pm",
       "source": "./plugins/aidd-pm",
       "description": "Product backlog artifacts, refinement, Product Briefs, Epics, User Stories, Tasks, Spikes, Defects, requirements, and specs.",
       "strict": true,
-      "recommended": true
+      "metadata": { "recommended": true }
     },
     {
       "name": "aidd-orchestrator",
       "source": "./plugins/aidd-orchestrator",
       "description": "Orchestration: synchronous SDLC pipeline, async issue-to-PR automation, and product backlog.",
       "strict": true,
-      "recommended": true
+      "metadata": { "recommended": true }
     },
     {
       "name": "aidd-refine",
       "source": "./plugins/aidd-refine",
       "description": "Meta-cognition: refine input through brainstorming, refine output through challenge, blind-spot scanning, and fact-checking.",
       "strict": true,
-      "recommended": true
+      "metadata": { "recommended": true }
     },
     {
       "name": "aidd-ui",
       "source": "./plugins/aidd-ui",
       "description": "ALPHA, not ready for use. UI and UX concern: design, review, and improve frontend interfaces.",
       "strict": true,
-      "recommended": false
+      "metadata": { "recommended": false }
+    },
+    {
+      "name": "aidd-telemetry",
+      "source": "./plugins/aidd-telemetry",
+      "description": "Measurement: journals every session so a unit of work can be tied to what it cost. The hooks record on plain node; its three skills reach the `aidd` CLI to turn it on, answer and check.",
+      "strict": true,
+      "metadata": { "recommended": false }
     }
   ]
 }

.claude/settings.json

@@ -1,18 +1,5 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "extraKnownMarketplaces": {
-    "aidd-framework": {
-      "source": { "source": "directory", "path": "." }
-    }
-  },
-  "enabledPlugins": {
-    "aidd-context@aidd-framework": true,
-    "aidd-dev@aidd-framework": true,
-    "aidd-vcs@aidd-framework": true,
-    "aidd-pm@aidd-framework": true,
-    "aidd-orchestrator@aidd-framework": true,
-    "aidd-refine@aidd-framework": true
-  },
   "hooks": {
     "WorktreeCreate": [
       {
@@ -24,5 +11,21 @@
         ]
       }
     ]
+  },
+  "enabledPlugins": {
+    "aidd-context@aidd-framework": true,
+    "aidd-dev@aidd-framework": true,
+    "aidd-vcs@aidd-framework": true,
+    "aidd-pm@aidd-framework": true,
+    "aidd-orchestrator@aidd-framework": true,
+    "aidd-refine@aidd-framework": true
+  },
+  "extraKnownMarketplaces": {
+    "aidd-framework": {
+      "source": {
+        "source": "directory",
+        "path": "."
+      }
+    }
   }
 }

.github/dependabot.yml

@@ -29,6 +29,14 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    # devDependencies batch into one PR instead of one per package — the CLI's
+    # Windows job alone runs ~8 min, and an unrelated bump should not pay for it once
+    # per dependency.
+    groups:
+      npm-dev-dependencies:
+        dependency-type: "development"
+        patterns:
+          - "*"
     commit-message:
       prefix: "chore"
       include: "scope"
@@ -42,6 +50,29 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    groups:
+      npm-dev-dependencies:
+        dependency-type: "development"
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "npm"
+    directory: "kanban"
+    target-branch: "next"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      npm-dev-dependencies:
+        dependency-type: "development"
+        patterns:
+          - "*"
     commit-message:
       prefix: "chore"
       include: "scope"

.github/rulesets/main.json

@@ -20,7 +20,8 @@
         "dismiss_stale_reviews_on_push": false,
         "require_code_owner_review": true,
         "require_last_push_approval": false,
-        "required_review_thread_resolution": true
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true
       }
     },
     {
@@ -29,7 +30,8 @@
         "strict_required_status_checks_policy": false,
         "required_status_checks": [
           {"context": "lefthook (framework-local checks)"},
-          {"context": "Commitlint"}
+          {"context": "Commitlint"},
+          {"context": "cli / gate"}
         ]
       }
     },

.github/rulesets/next.json

@@ -20,7 +20,8 @@
         "dismiss_stale_reviews_on_push": false,
         "require_code_owner_review": false,
         "require_last_push_approval": false,
-        "required_review_thread_resolution": false
+        "required_review_thread_resolution": false,
+        "require_extra_approval_for_unattributed_changes": true
       }
     },
     {
@@ -29,7 +30,8 @@
         "strict_required_status_checks_policy": false,
         "required_status_checks": [
           {"context": "lefthook (framework-local checks)"},
-          {"context": "Commitlint"}
+          {"context": "Commitlint"},
+          {"context": "cli / gate"}
         ]
       }
     },

.github/workflows/back-merge.yml

@@ -1,11 +1,12 @@
 name: Back-merge
 
-# After a release on main, sync main back into next so its changelog, manifest,
-# and version bumps do not drift. When next holds no unreleased work, realign it
-# onto main's hashes (force-push, the App is an "always" bypass actor on next)
-# so the rebase-promote hash drift cannot accumulate. When next has real work,
-# keep the merge. Conflict -> open a PR for a human. Any other failure -> open a
-# tracking issue so the drift is never silent.
+# After a release on main, fold main's changelog, manifest and version bumps back into next.
+#
+# A plain merge, because promote.yml lands as a merge commit: main and next share a real
+# merge base, so only the release commit is left to reconcile. Conflict opens a PR instead.
+#
+# A release can publish several tags at once, firing this once per tag: the first run folds
+# main in, the rest find it already merged rather than each opening a duplicate PR.
 
 on:
   release:
@@ -37,39 +38,35 @@ jobs:
       - name: Merge main into next
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
         run: |
+          set -euo pipefail
+
           git config user.name "aidd-bot[bot]"
           git config user.email "aidd-bot[bot]@users.noreply.github.com"
           git fetch origin main
-          if git merge --no-edit origin/main; then
-            # Promotes to main are rebase-merged, so main carries new commit
-            # hashes and next drifts even though the content matches. When the
-            # merge result is content-identical to main (next held no unreleased
-            # work), realign next onto main's clean hashes so the drift cannot
-            # accumulate into a giant conflicting promote later. Otherwise next
-            # has real unreleased work, so keep the merge and push normally.
-            if git diff --quiet origin/main HEAD; then
-              git push --force origin "origin/main:refs/heads/next"
-            else
-              git push origin next
-            fi
+
+          if git merge-base --is-ancestor origin/main HEAD; then
+            echo "next already contains main; nothing to back-merge."
+            exit 0
+          fi
+
+          # `ci:` on purpose: the type is absent from release-please's changelog-sections,
+          # so this plumbing commit never surfaces in a changelog, and commitlint accepts it.
+          if git merge --no-ff -m "ci: back-merge main into next" origin/main; then
+            git push origin next
           else
             git merge --abort
-            BRANCH="back-merge/main-to-next-${{ github.run_id }}"
+            BRANCH="back-merge/main-to-next-${RUN_ID}"
             git checkout -b "$BRANCH" origin/main
             git push origin "$BRANCH"
-            # promote.yml matches this exact title prefix to recognize a
-            # squash-merged conflict resolution as a sync boundary (this repo
-            # disallows merge-commit PRs, so this can't land as a real merge
-            # commit). Keep both in sync if you change it.
-            gh pr create --base next --head "$BRANCH" \
-              --title "chore: back-merge main into next (conflicts)" \
-              --body "Automated back-merge hit conflicts (CHANGELOG / manifest / version files). Resolve manually, then merge into next." \
-              --repo "${{ github.repository }}"
+            gh pr create --repo "$REPO" --base next --head "$BRANCH" \
+              --title "ci: back-merge main into next (conflicts)" \
+              --body "Automated back-merge hit conflicts. Resolve manually, then **merge with a merge commit, not a squash**: the second parent is what keeps a shared merge base between \`main\` and \`next\`, and a squash puts the next back-merge back into conflict."
           fi
 
-      # Never let a back-merge fail silently: a rejected push or any other error
-      # opens a tracking issue so a human resyncs main into next.
+      # A rejected push, or any other error, must not leave next drifting silently.
       - name: Open tracking issue on failure
         if: failure()
         env: