feat(workflow): publish gates, post-execute review, and product-facing PR skill (v2.6)

[David405]

Summary

Kit v2.6 locks in workflow lessons from consumer adoption: agents must not commit/push/open PRs without explicit human approval, must run harness-review after VERIFY before staging, and must open GitHub PRs using a detailed product-facing template with no contract paste or feature-ledger IDs.

Problem

Consumer repos were seeing harness leakage on GitHub (contract IDs in titles, harness-review sections in PR bodies, auto-commit on "approve"), sparse PR descriptions, and sprint-contract docs still requiring contract paste in PR bodies despite contracts being local gitignored state.

Solution

• Three new always-on rules: no-git-publish-without-approval, post-execute-review, pr-creation (nine rules total).
• Updated rules: strengthened git publish gate and review-before-stage in no-stage-harness-files, contract-before-changes, new-work-new-branch.
• New skill: create-pull-request with detailed PR template (Summary, Problem, Solution, behaviour table, files, risk, test plan).
• Sprint contract: PR section now points to create-pull-request skill instead of contract HTML markers in GitHub.
• Setup script: installs .github/pull_request_template.md from the skill when missing.
• Docs: README v2.6, rules README budget update, harness-review template locates contract on disk.

Behaviour changes

Before	After
Six rules; PR body expected to carry contract markers	Nine rules; contracts stay local; PRs are product-facing only
VERIFY → stage → (optional review)	VERIFY → review in chat → stage → stop until human asks to publish
No kit PR skill	create-pull-request skill + GitHub template

Files changed

• rules/no-git-publish-without-approval.mdc — explicit publish approval gate
• rules/post-execute-review.mdc — review before staging; output in chat only
• rules/pr-creation.mdc — always use create-pull-request skill
• rules/contract-before-changes.mdc, no-stage-harness-files.mdc, new-work-new-branch.mdc — aligned publish/review wording
• skills/create-pull-request/ — skill + templates/pull_request_template.md
• skills/sprint-contract/ — local contracts; no PR paste requirement
• skills/harness-review/templates/REVIEW.md — contract read from disk
• scripts/setup-harness-kit.sh — optional PR template install
• README.md, rules/README.md, FEATURES.json, .github/workflows/harness.yml — v2.6 docs and CI notes

Risk and rollout

• Risk: Low — additive rules/skills; consumers re-run setup-harness-kit.sh after submodule bump to link new rules and skill.
• Rollback: Revert submodule pointer to pre-v2.6 commit.
• Prod / env notes: Consumer repos should git submodule update --remote harness-kit && ./harness-kit/scripts/setup-harness-kit.sh after merge.

Test plan

• [ "$(ls rules/*.mdc | wc -l)" = 9 ] — nine rules present
• ./scripts/verify-harness.sh — passes on feature branch (expected FAIL on master until merge)
• python3 -m json.tool FEATURES.json — valid
• CI harness workflow on this PR

Made with Cursor