[tbhb-agent]

Summary

Classify replacement Go enforcement packages, command entry points, and command registration as golden paths and owner paths. Preserve existing protection, the golden-only waiver, and helper exclusions.

Why

Enforcement replacements need protection before callers switch to them. Extending the existing policy gives those paths the same owner-review rules as their shell predecessors without making them constitutional.

Verification

The commands below ran on the head of this pull request after the rebase onto the current default branch.

AC	Command	Result
AC1	mise run test-hooks tests/skills/agent-merge-pr	Passed: replacement paths require current-head owner approval and keep the golden-only waiver.
AC2	mise run test-hooks tests/skills/agent-merge-pr and bats --filter 'AC2 existing pattern' tests/skills/agent-merge-pr/go-protection.bats in a shallow checkout	Passed: preserved baseline patterns, excluded helpers, stale-head refusal, deletion, and rename coverage. The shallow-checkout case failed before the fixture fix and passed afterward without origin/main.
AC3	gh query repos/tbhb-dev/devtools/issues/755 --jq .body and gh query repos/tbhb-dev/devtools/issues/756 --jq .body	Both Dependencies sections require #753. Merge order and merged protection commit citations remain pending for the port pull requests.

Documentation: docs/agent-skills-migration.md explains the prerequisite and merged-commit evidence required for enforcement ports.

Native macOS and Windows verification remains with CI.

Risk

Compatibility: none

Loosens: no

An overly broad pattern could require owner review for helpers. A narrow pattern could leave enforcement unprotected. Positive and negative path assertions check that boundary. Revert the commit to restore the previous patterns. This pull request requires the owner's exact-head approval before merge.

Related

Closes #753. Part of #588. Prerequisite for #755 and #756. Merge-order evidence remains pending until this protection change merges.

[tbhb-dev-reviews]

Reviewed head: e4e1d6d
Review: CHANGES REQUESTED
Loosens: no
Owner-tier: yes (.agents/agent-skills.conf:9); exact-head owner approval remains required.

Read the live issue body and all eight comments. The latest Refinement verdict is READY, with golden-only protection explicitly excluding the new Go paths from owner and constitutional sets.

Live AC	Met on this head?	Evidence and remaining work
AC1	No	.agents/agent-skills.conf:4 adds the golden classifications, but .agents/agent-skills.conf:9 also adds every replacement to owner_paths, expressly forbidden by AC1. tests/skills/agent-merge-pr/go-protection.bats:30 asserts the forbidden owner signal. Existing waiver evaluation remains unchanged at packages/agents/source/skills/merge-pr/shared/scripts/merge-policy.py:541 and packages/agents/source/skills/merge-pr/shared/scripts/merge-policy.py:576; missing, duplicated and yes answers are covered by tests/skills/agent-merge-pr/loosens.bats:97.
AC2	No	Existing alternatives remain intact and helper exclusions are represented at tests/skills/agent-merge-pr/go-protection.bats:96; stale-head and rename/deletion cases are at lines 59 and 71. However, the owner pattern acquires replacement matches at .agents/agent-skills.conf:9, contrary to the bounded protection contract.
AC3	No, rollout proof pending	docs/agent-skills-migration.md:159 records the prerequisite and merged-commit evidence requirement. Live #755 and #756 both list #753 under Dependencies. Proof that protection merges first and citations of its merged commit belong to those later caller-switch slices and future enforcement ports. No Go port belongs in this PR.

This head does not satisfy every live AC. The PR description must use Related #753 rather than Closes #753, and retain the AC1/AC2/AC3 evidence mapping while distinguishing completed work from later rollout evidence. Merging this head should not claim completion of #753.

Changed paths from git diff --name-status origin/main...e4e1d6da7c352425396cb3f1cf75b6226f798703:

Status	Path	Owner-tier
M	.agents/agent-skills.conf	Yes
M	docs/agent-skills-migration.md	No
A	tests/skills/agent-merge-pr/fixtures/pre-go-protection.conf	No
A	tests/skills/agent-merge-pr/go-protection.bats	No

Owner-tier here means the specified protected surface, distinct from ordinary CODEOWNERS routing: .github/CODEOWNERS:6 routes all four paths to @tbhb.

Findings:

1. P1 - Shell freeze violation: tests/skills/agent-merge-pr/go-protection.bats:1 introduces 122 lines of Bats shell code. Additions are edits under the active freeze; this is neither a deletion nor regenerated vendor output. Replace this addition with permitted coverage or obtain an explicit change to the freeze before landing.
2. P2 - Keep replacement paths out of owner_paths: .agents/agent-skills.conf:9 appends the same Go expression used for golden protection. This changes the owner-path signal and violates AC1 even though a golden-only App waiver can still clear the merge-policy findings. The simpler required implementation extends only golden_paths and leaves owner_paths unchanged. Align the assertions at tests/skills/agent-merge-pr/go-protection.bats:30, line 80, line 88 and line 95 with that boundary.
3. P2 - Premature issue closure: docs/agent-skills-migration.md:159 identifies remaining rollout evidence, and the PR's Related section acknowledges it is pending while using a closing reference. AC1/AC2 are also unmet on this head. Use Related #753 until the live completion criteria are satisfied; the description's Summary must also stop presenting owner-path expansion as the requested outcome.

Over-engineering: no additional unnecessary guard, option, abstraction or layer found. The existing policy mechanism is sufficient; removing the extra owner-pattern alternative is the required simplification.

Loosening inspection: no newly introduced suppression marker, skipped test or weakened existing assertion. The loosening_markers setting is unchanged. Literal zero occurrences of nolint across whole changed files is not satisfied: pre-existing occurrences remain at .agents/agent-skills.conf:6 and docs/agent-skills-migration.md:68 and line 161; none is added by this diff.

Size: scc 4.1.0 counted additions and deletions separately, with Bats mapped to Shell and configuration counted as code. No vendor changes. Raw churn is 131 additions + 2 deletions = 133 lines: 129 code/config/test lines and 4 prose lines. Excluding blanks/comments, scc reports 119 code/config lines and 2 prose lines. Both measures are below 800 code and 2000 prose; no size finding.

Checks were read once: every reported context is COMPLETED SUCCESS. Coverage: SUCCESS. CodeQL: SUCCESS, including Go and Actions analysis. The PR is non-draft, MERGEABLE, with mergeStateStatus BLOCKED. Mechanical gates were not rerun. Each of the four exact-head non-vendor files passed the private-list leak scan individually; this review body was also scanned before posting.

The definition of done for #753 (Feature):

• D1 The author verified each AC on the merged head, and the Verification section of the pull request cites each AC ID with its evidence: the command and its result, or a link. Unmet: AC1/AC2 findings and AC3 rollout proof; description does cite all three IDs.
• D2 An independent reviewer approved the exact merged head, and the author resolved each finding or filed it as a follow-up. Unmet: this review requests changes; findings need disposition.
• D3 The required checks pass on that head, and any loosened gate has the owner's approval of that exact head. All reported contexts completed successfully; no gate loosening found. Protected-file owner approval remains a separate merge requirement.
• D4 The leak scans come back clean: gitleaks, devtools' check-leaks.sh with the repository's private-strings list, and the leak review of each post. Evidence: successful gitleaks context, four individual exact-head private-list scans and pre-post body scan. Prior posts' private-list review history was not independently established.
• D5 The author signed each commit, the squash included. Both current commits have GitHub verification verified=true, reason=valid; the future squash is not yet available.
• D6 The docs match the change (README, docs/, CHANGELOG or help text), or the Verification section says "No doc impact" and why. Golden protection and adoption order are documented at docs/agent-skills-migration.md:157 and line 159; owner-pattern mismatch is tracked above.
• D7 The commits and the squash have Assisted-by trailers, and the pull request has the provenance:agent-assisted label. Both current commits have the trailer and the PR has the label; future squash remains unverified.
• D8 The pull request stays within the size limits, or the owner approved its exact head over the hard limit. Evidence: scc measurement above.
• D9 The author files follow-ups and deferred findings as issues with at least a Problem and numbered AC and lists them under the Related section of the pull request. Any work left in the code links its issue. Findings from this review await disposition; #755 and #756 are named in Related and contain Problem and numbered AC sections.
• D10 The merge closes the issue through a closing reference and the board shows Done. The final Status: comment names the merge commit. Unmet: not merged; closure would be premature on this head.
• devtools-1 mise run check is green, and so are the coverage floors mise run cover-go-check and mise run cover-py-check, which check does not run. CI and coverage contexts are successful; the exact local command record is not established and was not rerun.
• devtools-2 A change to skill sources under packages/agents/source/ commits what generate-skills, skill-tokens and apm install rewrite, in that order, and check-generated-skills passes. Not applicable: no skill-source change.
• devtools-3 A consumer-visible change has its consumer steps in docs/agent-skills-migration.md or adoption docs, or Verification says "No consumer impact" and why. Evidence: docs/agent-skills-migration.md:157 and line 159.

Round: 1 of 3