Group recipes by audience and post only through just publish

Andrew Dunnrequested to merge
regroup-recipes-by-audience into main

What

Recipes now group by audience, and just publish <draft> is the only recipe that posts. This lands before the next tag, so the first tagged release carries the rule.

  • just lab ... is the simulator (rigs the operator owns).
  • just contrib ... is contribution to projects we do not own. A recipe that would post writes a draft file, prints it and exits 0, with no network call and no write.
  • just publish <draft> posts the draft's text and nothing else. It runs upstream-post when that is on PATH, so the operator's gate and AI-disclosure check apply, and plain glab otherwise.
  • allowed-tools is Bash(just lab *) Bash(just contrib *) Bash(just ci) Bash(just check) Bash(just lint) Bash(just test) Bash(just sims-check) Read. It leaves publish out, so the harness asks at exactly the public write.

ADR-0005 records the rule. It extends ADR-0001 instead of carving contribution out of it, and it supersedes ADR-0004's skills/gitlab-contribution/ path, since accepted ADRs are not edited.

The posting path

flowchart LR
  C["just contrib recipe"] --> D["draft file, printed"]
  D --> A{"approved?"}
  A -- no --> D
  A -- yes --> P["just publish draft"]
  P -- "upstream-post on PATH" --> U["upstream-post: gate and disclosure check"]
  P -- "otherwise" --> G["glab"]
  U --> F[("forge")]
  G --> F

A docs MR draft records the sha256 of its commit message and each page. publish.sh refuses a draft whose files changed since, so the text that was shown is the text that posts. docs-mr.sh and ids-batch-apply.sh exit 64 unless publish.sh started them.

Recipe map

Group Count Recipes Posts
lab 55 (and a menu) every former top-level simulator recipe: up, down, status, ssh, ssh-cmd, license, aigw, real-model, seed, dap-bootstrap, doctor, drift-check, validate, geo, openshift, and the rest no
contrib read 7 dupcheck, search, clone, rebase, lint-message, docs-lint, danger-spec no
contrib draft 3 docs-mr, apply-suggestions, draft <kind> no, writes a draft
check 5 ci, check, lint, test, sims-check (root justfile; the other 12 root gates are not in allowed-tools) no
publish 1 publish <draft> yes, the only one
Script Reached through
docs-mr.sh just contrib docs-mr drafts it, just publish runs it
ids-batch-apply.sh just contrib apply-suggestions drafts it, just publish runs it
dupcheck.sh, gl-search.sh, disposable-clone.sh, rebase-via-patch.sh, lint-message.sh, docs-lint.sh, danger-spec-suggestions.sh the seven contrib read recipes
draft.sh, publish.sh (new) contrib draft recipes; just publish

draft <kind> covers the kinds upstream-post takes for text: notes, discussions, replies, note edits, resolve, and creating or updating an MR or issue. The skill text that named glab issue create, a notes POST or glab mr create now names a draft and just publish.

Old recipe names are gone, not aliased: just up is just lab up, and every reference in the skill text, scripts, tests and docs moved with it. The skill is invoked from its own directory, since the permission pattern matches just lab ... and not just -f <path> lab .... Teardown lines the engine prints still use just -f <path> lab down, which works from any directory.

Not covered

  • A pipeline trigger and an MR rebase carry no text and have no draft kind. They stay raw glab, which allowed-tools does not list, so the harness asks on them too.
  • A suggestion batch posts through glab even when upstream-post is present, because upstream-post has no kind for it. publish says so.
  • docs-lint and the page-version guard need the network, so just contrib docs-mr does not run them. just publish runs them before it writes anything.

Tests

New section in tests/run.sh, "recipes group by audience and one recipe posts":

  • allowed-tools equals the ruling exactly, omits publish, and has no bare just *.
  • Only publish.sh runs a posting script; only docs-mr.sh, ids-batch-apply.sh and publish.sh carry a forge write; both posting scripts exit 64 when run by path, before any call.
  • just contrib docs-mr, draft and apply-suggestions write a draft and exit 0 with a glab and an upstream-post that fail the test if touched.
  • just publish with a stub upstream-post on PATH calls it with the draft's kind, host, project and iid, and not glab; without it, glab is called with the endpoint and method. The same for the docs MR's commit and MR.
  • A page edited after the draft is refused before anything is sent; a file that is not a draft is refused.
  • Group counts: 55 lab, 10 contrib and their menus, two top-level recipes.

just ci passes. The description is unchanged, so sims-check still matches the recorded hash and no battery is re-recorded. The body edits rename recipes and add a posting section; they do not restructure it.

Merge request reports